archive mirror
 help / color / mirror / Atom feed
Subject: [PATCH] 2.4.x i386 SMP interrupts can corrupt registers
Date: Wed, 29 Aug 2001 11:47:30 -0700 (PDT)	[thread overview]
Message-ID: <> (raw)

Currently, the SMP interrupt code generated by the macros
interrupt vector number on the stack. If the correct signal is pending
on the process and %eax happens to have the correct value, do_signal()
can be spoofed into adjusting %eax and %eip with almost certainly bad
results. For example, trying to do a "strace -p" the following program
will result in its dumping core with an illegal instruction.

	int i;

	asm (
		"mov %1,%0\n\t"
		"cmp %1,%0\n\t"
		"je 1b\n\t"
		:"=&a" (i)
		:"i" (-512));

	return i;

I suspect what was wanted was to subtract 256, as is done in BUILD_IRQ,
to make the values negative, but leave the vector available in %al, so
I offer the following patch against 2.4.10-pre2 to do so. (The 2.2.x
code simply pushes -1. I don't see anything that uses the vector for
these interrupt, so this should work. However, I assume the change was
made so the vector number would be available on the stack, perhaps for

This has only been tested by me on my SMP box, but... (I don't want to
complete that sentence with words I might be forced to regret for some

John Byrne

diff -Nar -u4 orig/include/asm-i386/hw_irq.h linux/include/asm-i386/hw_irq.h
--- orig/include/asm-i386/hw_irq.h	Mon Jul  9 13:28:00 2001
+++ linux/include/asm-i386/hw_irq.h	Wed Aug 29 09:48:38 2001
@@ -129,9 +129,9 @@
 asmlinkage void call_##x(void); \
 __asm__( \
 "\n"__ALIGN_STR"\n" \
 SYMBOL_NAME_STR(x) ":\n\t" \
-	"pushl $"#v"\n\t" \
+	"pushl $"#v"-256\n\t" \
 	SYMBOL_NAME_STR(call_##x)":\n\t" \
 	"call "SYMBOL_NAME_STR(smp_##x)"\n\t" \
 	"jmp ret_from_intr\n");
@@ -142,9 +142,9 @@
 asmlinkage void call_##x(void); \
 __asm__( \
 "\n"__ALIGN_STR"\n" \
 SYMBOL_NAME_STR(x) ":\n\t" \
-	"pushl $"#v"\n\t" \
+	"pushl $"#v"-256\n\t" \
 	"movl %esp,%eax\n\t" \
 	"pushl %eax\n\t" \
 	SYMBOL_NAME_STR(call_##x)":\n\t" \

             reply	other threads:[~2001-08-29 18:58 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2001-08-29 18:47 john.l.byrne [this message]
2001-08-30  3:39 ` Linus Torvalds
2001-08-30 18:41   ` John Byrne

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \
    --subject='Re: [PATCH] 2.4.x i386 SMP interrupts can corrupt registers' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).