From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932587AbbBZWln (ORCPT ); Thu, 26 Feb 2015 17:41:43 -0500 Received: from mail-pa0-f51.google.com ([209.85.220.51]:33847 "EHLO mail-pa0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932522AbbBZWlk (ORCPT ); Thu, 26 Feb 2015 17:41:40 -0500 From: Andy Lutomirski To: x86@kernel.org, linux-kernel@vger.kernel.org Cc: Borislav Petkov , Oleg Nesterov , Denys Vlasenko , Andy Lutomirski Subject: [PATCH 16/16] x86_64, entry: Remove a bogus ret_from_fork optimization Date: Thu, 26 Feb 2015 14:40:39 -0800 Message-Id: <4710be56d76ef994ddf59087aad98c000fbab9a4.1424989793.git.luto@amacapital.net> X-Mailer: git-send-email 2.1.0 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ret_from_fork checks TIF_IA32 to determine whether pt_regs and the related state make sense for ret_from_sys_call. This is entirely the wrong check. TS_COMPAT would make a little more sense, but there's really no point in keeping this optimization at all. This fixes a return to the wrong user CS if we came from int 0x80 in a 64-bit task. Acked-by: Ingo Molnar Signed-off-by: Andy Lutomirski --- arch/x86/kernel/entry_64.S | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S index 4670fcdb5150..519498d1c8ec 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -550,11 +550,14 @@ ENTRY(ret_from_fork) testl $3,CS(%rsp) # from kernel_thread? jz 1f - testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET - jnz int_ret_from_sys_call - - RESTORE_TOP_OF_STACK %rdi - jmp ret_from_sys_call # go to the SYSRET fastpath + /* + * By the time we get here, we have no idea whether our pt_regs, + * ti flags, and ti status came from the 64-bit SYSCALL fast path, + * the slow path, or one of the ia32entry paths. + * Use int_ret_from_sys_call to return, since it can safely handle + * all of the above. + */ + jmp int_ret_from_sys_call 1: movq %rbp, %rdi -- 2.1.0