LKML Archive on
 help / color / Atom feed
From: Sven Wegener <>
To: "H. Peter Anvin" <>
Cc: "Andy Lutomirski" <>,
	"Richard Weinberger" <>, "X86 ML" <>,
	"Eric Paris" <>,
	"Linux Kernel" <>,
	"Steven Rostedt" <>,
	"Borislav Petkov" <>,
	"Toralf Förster" <>,
	stable <>,
	"Roland McGrath" <>,
	"Josh Boyer" <>
Subject: [PATCH] x86_32, entry: store badsys error code in %eax
Date: Tue, 22 Jul 2014 10:26:06 +0200 (CEST)
Message-ID: <> (raw)

Commit 554086d ("x86_32, entry: Do syscall exit work on badsys
(CVE-2014-4508)") introduced a regression in the x86_32 syscall entry
code, resulting in syscall() not returning proper errors for undefined
syscalls on CPUs supporting the sysenter feature.

The following code:

> int result = syscall(666);
> printf("result=%d errno=%d error=%s\n", result, errno, strerror(errno));

results in:

> result=666 errno=0 error=Success

Obviously, the syscall return value is the called syscall number, but it
should have been an ENOSYS error. When run under ptrace it behaves
correctly, which makes it hard to debug in the wild:

> result=-1 errno=38 error=Function not implemented

The %eax register is the return value register. For debugging via ptrace
the syscall entry code stores the complete register context on the
stack. The badsys handlers only store the ENOSYS error code in the
ptrace register set and do not set %eax like a regular syscall handler
would. The old resume_userspace call chain contains code that clobbers
%eax and it restores %eax from the ptrace registers afterwards. The same
goes for the ptrace-enabled call chain. When ptrace is not used, the
syscall return value is the passed-in syscall number from the untouched
%eax register.

Use %eax as the return value register in syscall_badsys and
sysenter_badsys, like a real syscall handler does, and have the caller
push the value onto the stack for ptrace access.

Signed-off-by: Sven Wegener <>
Reviewed-and-tested-by: Andy Lutomirski <>

I've updated the commit message and added the Reviewed-and-tested-by and 

 arch/x86/kernel/entry_32.S | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index dbaa23e..0d0c9d4 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -425,8 +425,8 @@ sysenter_do_call:
 	cmpl $(NR_syscalls), %eax
 	jae sysenter_badsys
 	call *sys_call_table(,%eax,4)
-	movl %eax,PT_EAX(%esp)
+	movl %eax,PT_EAX(%esp)
@@ -502,6 +502,7 @@ ENTRY(system_call)
 	jae syscall_badsys
 	call *sys_call_table(,%eax,4)
 	movl %eax,PT_EAX(%esp)		# store the return value
@@ -675,12 +676,12 @@ syscall_fault:
-	movl $-ENOSYS,PT_EAX(%esp)
-	jmp syscall_exit
+	movl $-ENOSYS,%eax
+	jmp syscall_after_call
-	movl $-ENOSYS,PT_EAX(%esp)
+	movl $-ENOSYS,%eax
 	jmp sysenter_after_call

             reply index

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-07-22  8:26 Sven Wegener [this message]
2014-07-22 17:01 ` [tip:x86/urgent] x86_32, entry: Store " tip-bot for Sven Wegener
  -- strict thread matches above, loose matches on Subject: below --
2014-07-20 21:33 [PATCH] x86_32, entry: store " Sven Wegener
2014-07-20 22:07 ` H. Peter Anvin
2014-07-21 16:53   ` Andy Lutomirski
2014-07-21 17:20     ` H. Peter Anvin
2014-07-21 17:23       ` Andy Lutomirski
2014-07-21 21:59 ` Andy Lutomirski
2014-07-22  6:57   ` Sven Wegener

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on

Archives are clonable:
	git clone --mirror lkml/git/0.git
	git clone --mirror lkml/git/1.git
	git clone --mirror lkml/git/2.git
	git clone --mirror lkml/git/3.git
	git clone --mirror lkml/git/4.git
	git clone --mirror lkml/git/5.git
	git clone --mirror lkml/git/6.git
	git clone --mirror lkml/git/7.git
	git clone --mirror lkml/git/8.git
	git clone --mirror lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ \
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone