Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af726f21 authored by Andy Lutomirski's avatar Andy Lutomirski Committed by Linus Torvalds
Browse files

x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C 



There's nothing special enough about the espfix64 double fault fixup to
justify writing it in assembly.  Move it to C.

This also fixes a bug: if the double fault came from an IST stack, the
old asm code would return to a partially uninitialized stack frame.

Fixes: 3891a04a
Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent fc14f9c1

arch/x86/kernel/entry_64.S

+2 −32
Original line number Original line Diff line number Diff line
@@ -828,6 +828,7 @@ ENTRY(native_iret) 
	jnz native_irq_return_ldt

	jnz native_irq_return_ldt

#endif

#endif





.global native_irq_return_iret

native_irq_return_iret:

native_irq_return_iret:

	iretq

	iretq

	_ASM_EXTABLE(native_irq_return_iret, bad_iret)

	_ASM_EXTABLE(native_irq_return_iret, bad_iret)
@@ -922,37 +923,6 @@ ENTRY(retint_kernel) 
	CFI_ENDPROC

	CFI_ENDPROC

END(common_interrupt)

END(common_interrupt)





	/*

	 * If IRET takes a fault on the espfix stack, then we

	 * end up promoting it to a doublefault.  In that case,

	 * modify the stack to make it look like we just entered

	 * the #GP handler from user space, similar to bad_iret.

	 */

#ifdef CONFIG_X86_ESPFIX64

	ALIGN

__do_double_fault:

	XCPT_FRAME 1 RDI+8

	movq RSP(%rdi),%rax		/* Trap on the espfix stack? */

	sarq $PGDIR_SHIFT,%rax

	cmpl $ESPFIX_PGD_ENTRY,%eax

	jne do_double_fault		/* No, just deliver the fault */

	cmpl $__KERNEL_CS,CS(%rdi)

	jne do_double_fault

	movq RIP(%rdi),%rax

	cmpq $native_irq_return_iret,%rax

	jne do_double_fault		/* This shouldn't happen... */

	movq PER_CPU_VAR(kernel_stack),%rax

	subq $(6*8-KERNEL_STACK_OFFSET),%rax	/* Reset to original stack */

	movq %rax,RSP(%rdi)

	movq $0,(%rax)			/* Missing (lost) #GP error code */

	movq $general_protection,RIP(%rdi)

	retq

	CFI_ENDPROC

END(__do_double_fault)

#else

# define __do_double_fault do_double_fault

#endif



/*

/*

 * APIC interrupts.

 * APIC interrupts.

 */

 */
@@ -1124,7 +1094,7 @@ idtentry overflow do_overflow has_error_code=0 
idtentry bounds do_bounds has_error_code=0

idtentry bounds do_bounds has_error_code=0

idtentry invalid_op do_invalid_op has_error_code=0

idtentry invalid_op do_invalid_op has_error_code=0

idtentry device_not_available do_device_not_available has_error_code=0

idtentry device_not_available do_device_not_available has_error_code=0

idtentry double_fault __do_double_fault has_error_code=1 paranoid=1

idtentry double_fault do_double_fault has_error_code=1 paranoid=1

idtentry coprocessor_segment_overrun do_coprocessor_segment_overrun has_error_code=0

idtentry coprocessor_segment_overrun do_coprocessor_segment_overrun has_error_code=0

idtentry invalid_TSS do_invalid_TSS has_error_code=1

idtentry invalid_TSS do_invalid_TSS has_error_code=1

idtentry segment_not_present do_segment_not_present has_error_code=1

idtentry segment_not_present do_segment_not_present has_error_code=1

arch/x86/kernel/traps.c

+24 −0
Original line number Original line Diff line number Diff line
@@ -259,6 +259,30 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code) 
	static const char str[] = "double fault";

	static const char str[] = "double fault";

	struct task_struct *tsk = current;

	struct task_struct *tsk = current;





#ifdef CONFIG_X86_ESPFIX64

	extern unsigned char native_irq_return_iret[];



	/*

	 * If IRET takes a non-IST fault on the espfix64 stack, then we

	 * end up promoting it to a doublefault.  In that case, modify

	 * the stack to make it look like we just entered the #GP

	 * handler from user space, similar to bad_iret.

	 */

	if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&

		regs->cs == __KERNEL_CS &&

		regs->ip == (unsigned long)native_irq_return_iret)

	{

		struct pt_regs *normal_regs = task_pt_regs(current);



		/* Fake a #GP(0) from userspace. */

		memmove(&normal_regs->ip, (void *)regs->sp, 5*8);

		normal_regs->orig_ax = 0;  /* Missing (lost) #GP error code */

		regs->ip = (unsigned long)general_protection;

		regs->sp = (unsigned long)&normal_regs->orig_ax;

		return;

	}

#endif



	exception_enter();

	exception_enter();

	/* Return not checked because double check cannot be ignored */

	/* Return not checked because double check cannot be ignored */

	notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);

	notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);