Messages in this thread | | | Date | Thu, 23 Apr 2015 12:26:43 +0200 | From | Denys Vlasenko <> | Subject | Re: [tip:x86/vdso] x86/vdso32/syscall.S: Do not load __USER32_DS to %ss |
| |
On 04/23/2015 12:18 PM, Borislav Petkov wrote: > On Thu, Apr 23, 2015 at 11:56:21AM +0200, Denys Vlasenko wrote: >> The fix can look like this (untested): >> >> >> diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S >> index 0c302d0..9f4c232 100644 >> --- a/arch/x86/ia32/ia32entry.S >> +++ b/arch/x86/ia32/ia32entry.S >> @@ -198,6 +198,18 @@ sysexit_from_sys_call: >> * with 'sysenter' and it uses the SYSENTER calling convention. >> */ >> andl $~TS_COMPAT,ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS) >> + /* >> + * On AMD, SYSRET32 does not modify %ss cached descriptor; > > Ok, but doc says that in both long and compat mode, SYSRET does load > SS.sel with the value in MSR_STAR...
Yes. It loads *selector*. AMD docs say that selector is loaded as you say, but *cached descriptor* of SS (which is a different entity) is not modified.
If *cached descriptor* is invalid, in 32-bit mode stack ops will fail. (In 64-bit mode, CPU doesn't do those checks).
| |