Revert "x86: signal: change type of paramter for sys_rt_sigreturn()" (552b8aa4) · Commits · 戴 / test

This reverts commit . Justin Madru bisected this commit, it was causing weird Firefox crashes. The reason is that GCC mis-optimizes (re-uses) the on-stack parameters of the calling frame, which corrupts the syscall return pt_regs state and thus corrupts user-space register state. So we go back to the slightly less clean but more optimization-safe method of getting to pt_regs. Also add a comment to explain this. Resolves: http://bugzilla.kernel.org/show_bug.cgi?id=12505 Reported-and-bisected-by:

Justin Madru <jdm64@gawab.com> Tested-by:

Justin Madru <jdm64@gawab.com> Signed-off-by:

Ingo Molnar <mingo@elte.hu>

arch/x86/include/asm/syscalls.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -40,7 +40,7 @@ asmlinkage int sys_sigaction(int, const struct old_sigaction __user *,
		struct old_sigaction __user *);
		asmlinkage int sys_sigaltstack(unsigned long);
		asmlinkage unsigned long sys_sigreturn(unsigned long);
		asmlinkage int sys_rt_sigreturn(struct pt_regs);
		asmlinkage int sys_rt_sigreturn(unsigned long);

		/* kernel/ioport.c */
		asmlinkage long sys_iopl(unsigned long);

arch/x86/kernel/signal.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -632,9 +632,16 @@ badframe:
		}

		#ifdef CONFIG_X86_32
		asmlinkage int sys_rt_sigreturn(struct pt_regs regs)
		/*
		* Note: do not pass in pt_regs directly as with tail-call optimization
		* GCC will incorrectly stomp on the caller's frame and corrupt user-space
		* register state:
		*/
		asmlinkage int sys_rt_sigreturn(unsigned long __unused)
		{
		return do_rt_sigreturn(&regs);
		struct pt_regs regs = (struct pt_regs )&__unused;

		return do_rt_sigreturn(regs);
		}
		#else /* !CONFIG_X86_32 */
		asmlinkage long sys_rt_sigreturn(struct pt_regs *regs)

Admin message