Skip to content
  • Josh Poimboeuf's avatar
    x86/entry/64: Fix stack return address retrieval in thunk · d4bf7078
    Josh Poimboeuf authored
    
    
    With CONFIG_FRAME_POINTER enabled, a thunk can pass a bad return address
    value to the called function.  '9*8(%rsp)' actually gets the frame
    pointer, not the return address.
    
    The only users of the 'put_ret_addr_in_rdi' option are two functions
    which trace the enabling and disabling of interrupts, so this bug can
    result in bad debug or tracing information with CONFIG_IRQSOFF_TRACER or
    CONFIG_PROVE_LOCKING.
    
    Fix this by implementing the suggestion of Linus: explicitly push
    the frame pointer all the time and constify the stack offsets that
    way. This is both correct and easier to read.
    
    Reported-by: default avatarMatt Fleming <matt@codeblueprint.co.uk>
    Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
    [ Extended the changelog a bit. ]
    Acked-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Cc: Alex Thorlton <athorlton@sgi.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Fixes: 058fb732 ("x86/asm/entry: Create stack frames in thunk functions")
    Link: http://lkml.kernel.org/r/20160517180606.v5o7wcgdni7443ol@treble
    
    
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    d4bf7078