Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36d001c7 authored by H. Peter Anvin's avatar H. Peter Anvin
Browse files

x86-64, compat: Test %rax for the syscall number, not %eax 



On 64 bits, we always, by necessity, jump through the system call
table via %rax.  For 32-bit system calls, in theory the system call
number is stored in %eax, and the code was testing %eax for a valid
system call number.  At one point we loaded the stored value back from
the stack to enforce zero-extension, but that was removed in checkin
d4d67150.  An actual 32-bit process
will not be able to introduce a non-zero-extended number, but it can
happen via ptrace.

Instead of re-introducing the zero-extension, test what we are
actually going to use, i.e. %rax.  This only adds a handful of REX
prefixes to the code.

Reported-by: default avatarBen Hawkes <hawkes@sota.gen.nz>
Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
Cc: <stable@kernel.org>
Cc: Roland McGrath <roland@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
parent c41d68a5

arch/x86/ia32/ia32entry.S

+7 −7
Original line number Diff line number Diff line
@@ -153,7 +153,7 @@ ENTRY(ia32_sysenter_target) 
	testl  $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)

	CFI_REMEMBER_STATE

	jnz  sysenter_tracesys

	cmpl	$(IA32_NR_syscalls-1),%eax

	cmpq	$(IA32_NR_syscalls-1),%rax

	ja	ia32_badsys

sysenter_do_call:

	IA32_ARG_FIXUP
@@ -195,7 +195,7 @@ sysexit_from_sys_call: 
	movl $AUDIT_ARCH_I386,%edi	/* 1st arg: audit arch */

	call audit_syscall_entry

	movl RAX-ARGOFFSET(%rsp),%eax	/* reload syscall number */

	cmpl $(IA32_NR_syscalls-1),%eax

	cmpq $(IA32_NR_syscalls-1),%rax

	ja ia32_badsys

	movl %ebx,%edi			/* reload 1st syscall arg */

	movl RCX-ARGOFFSET(%rsp),%esi	/* reload 2nd syscall arg */
@@ -248,7 +248,7 @@ sysenter_tracesys: 
	call	syscall_trace_enter

	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */

	RESTORE_REST

	cmpl	$(IA32_NR_syscalls-1),%eax

	cmpq	$(IA32_NR_syscalls-1),%rax

	ja	int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */

	jmp	sysenter_do_call

	CFI_ENDPROC
@@ -314,7 +314,7 @@ ENTRY(ia32_cstar_target) 
	testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)

	CFI_REMEMBER_STATE

	jnz   cstar_tracesys

	cmpl $IA32_NR_syscalls-1,%eax

	cmpq $IA32_NR_syscalls-1,%rax

	ja  ia32_badsys

cstar_do_call:

	IA32_ARG_FIXUP 1
@@ -367,7 +367,7 @@ cstar_tracesys: 
	LOAD_ARGS32 ARGOFFSET, 1  /* reload args from stack in case ptrace changed it */

	RESTORE_REST

	xchgl %ebp,%r9d

	cmpl $(IA32_NR_syscalls-1),%eax

	cmpq $(IA32_NR_syscalls-1),%rax

	ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */

	jmp cstar_do_call

END(ia32_cstar_target)
@@ -425,7 +425,7 @@ ENTRY(ia32_syscall) 
	orl   $TS_COMPAT,TI_status(%r10)

	testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)

	jnz ia32_tracesys

	cmpl $(IA32_NR_syscalls-1),%eax

	cmpq $(IA32_NR_syscalls-1),%rax

	ja ia32_badsys

ia32_do_call:

	IA32_ARG_FIXUP
@@ -444,7 +444,7 @@ ia32_tracesys: 
	call syscall_trace_enter

	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */

	RESTORE_REST

	cmpl $(IA32_NR_syscalls-1),%eax

	cmpq $(IA32_NR_syscalls-1),%rax

	ja  int_ret_from_sys_call	/* ia32_tracesys has set RAX(%rsp) */

	jmp ia32_do_call

END(ia32_syscall)