x86/entry/32: Unwind the ESPFIX stack earlier on exception entry
authorAndy Lutomirski <luto@kernel.org>
Wed, 20 Nov 2019 09:10:49 +0000 (10:10 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 29 Nov 2019 09:09:57 +0000 (10:09 +0100)
commit778226c41e6a146f13bd6bd09390a9dd3f946f32
tree6b6c114dbadd5fc8e497d97349a4fa508278a5b9
parent9352a3a1eee47e80ab8a3b977b2b9b97298b7157
x86/entry/32: Unwind the ESPFIX stack earlier on exception entry

commit a1a338e5b6fe9e0a39c57c232dc96c198bb53e47 upstream.

Right now, we do some fancy parts of the exception entry path while SS
might have a nonzero base: we fill in regs->ss and regs->sp, and we
consider switching to the kernel stack. This results in regs->ss and
regs->sp referring to a non-flat stack and it may result in
overflowing the entry stack. The former issue means that we can try to
call iret_exc on a non-flat stack, which doesn't work.

Tested with selftests/x86/sigreturn_32.

Fixes: 45d7b255747c ("x86/entry/32: Enter the kernel via trampoline stack")
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/x86/entry/entry_32.S