x86: don't destroy %rbp on kernel-mode faults
From the code: "B stepping K8s sometimes report an truncated RIP for IRET exceptions returning to compat mode. Check for these here too." The code then proceeds to truncate the upper 32 bits of %rbp. This means that when do_page_fault() is finally called, its prologue, do_page_fault: push %rbp movl %rsp, %rbp will put the truncated base pointer on the stack. This means that the stack tracer will not be able to follow the base-pointer changes and will see all subsequent stack frames as unreliable. This patch changes the code to use a different register (%rcx) for the checking and leaves %rbp untouched. Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com> Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi> Acked-by: Arjan van de Ven <arjan@linux.intel.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Ingo Molnar <mingo@elte.hu>
This commit is contained in:
Родитель
543cf4cb3f
Коммит
9d8ad5d6c7
|
@ -926,11 +926,11 @@ error_kernelspace:
|
||||||
iret run with kernel gs again, so don't set the user space flag.
|
iret run with kernel gs again, so don't set the user space flag.
|
||||||
B stepping K8s sometimes report an truncated RIP for IRET
|
B stepping K8s sometimes report an truncated RIP for IRET
|
||||||
exceptions returning to compat mode. Check for these here too. */
|
exceptions returning to compat mode. Check for these here too. */
|
||||||
leaq irq_return(%rip),%rbp
|
leaq irq_return(%rip),%rcx
|
||||||
cmpq %rbp,RIP(%rsp)
|
cmpq %rcx,RIP(%rsp)
|
||||||
je error_swapgs
|
je error_swapgs
|
||||||
movl %ebp,%ebp /* zero extend */
|
movl %ecx,%ecx /* zero extend */
|
||||||
cmpq %rbp,RIP(%rsp)
|
cmpq %rcx,RIP(%rsp)
|
||||||
je error_swapgs
|
je error_swapgs
|
||||||
cmpq $gs_change,RIP(%rsp)
|
cmpq $gs_change,RIP(%rsp)
|
||||||
je error_swapgs
|
je error_swapgs
|
||||||
|
|
Загрузка…
Ссылка в новой задаче