mirror of
https://github.com/torvalds/linux.git
synced 2024-12-12 14:12:51 +00:00
x86/entry/64: Fix stack return address retrieval in thunk
With CONFIG_FRAME_POINTER enabled, a thunk can pass a bad return address
value to the called function. '9*8(%rsp)' actually gets the frame
pointer, not the return address.
The only users of the 'put_ret_addr_in_rdi' option are two functions
which trace the enabling and disabling of interrupts, so this bug can
result in bad debug or tracing information with CONFIG_IRQSOFF_TRACER or
CONFIG_PROVE_LOCKING.
Fix this by implementing the suggestion of Linus: explicitly push
the frame pointer all the time and constify the stack offsets that
way. This is both correct and easier to read.
Reported-by: Matt Fleming <matt@codeblueprint.co.uk>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
[ Extended the changelog a bit. ]
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 058fb73274
("x86/asm/entry: Create stack frames in thunk functions")
Link: http://lkml.kernel.org/r/20160517180606.v5o7wcgdni7443ol@treble
Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
parent
683ad8092c
commit
d4bf7078c4
@ -8,16 +8,15 @@
|
||||
#include <linux/linkage.h>
|
||||
#include "calling.h"
|
||||
#include <asm/asm.h>
|
||||
#include <asm/frame.h>
|
||||
|
||||
/* rdi: arg1 ... normal C conventions. rax is saved/restored. */
|
||||
.macro THUNK name, func, put_ret_addr_in_rdi=0
|
||||
.globl \name
|
||||
.type \name, @function
|
||||
\name:
|
||||
FRAME_BEGIN
|
||||
pushq %rbp
|
||||
movq %rsp, %rbp
|
||||
|
||||
/* this one pushes 9 elems, the next one would be %rIP */
|
||||
pushq %rdi
|
||||
pushq %rsi
|
||||
pushq %rdx
|
||||
@ -29,8 +28,8 @@
|
||||
pushq %r11
|
||||
|
||||
.if \put_ret_addr_in_rdi
|
||||
/* 9*8(%rsp) is return addr on stack */
|
||||
movq 9*8(%rsp), %rdi
|
||||
/* 8(%rbp) is return addr on stack */
|
||||
movq 8(%rbp), %rdi
|
||||
.endif
|
||||
|
||||
call \func
|
||||
@ -65,7 +64,7 @@ restore:
|
||||
popq %rdx
|
||||
popq %rsi
|
||||
popq %rdi
|
||||
FRAME_END
|
||||
popq %rbp
|
||||
ret
|
||||
_ASM_NOKPROBE(restore)
|
||||
#endif
|
||||
|
Loading…
Reference in New Issue
Block a user