Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1526164 > unrolled thread

[PATCH urgent] x86/traps: Ignore high word of regs->cs in early_fixup_exception()

Back to article view | Back to linux.kernel

Contents

  [PATCH urgent] x86/traps: Ignore high word of regs->cs in early_fixup_exception() Andy Lutomirski <luto@kernel.org> - 2016-11-20 03:50 +0100
    [tip:x86/urgent] x86/traps: Ignore high word of regs->cs in  early_fixup_exception() tip-bot for Andy Lutomirski <tipbot@zytor.com> - 2016-11-21 09:10 +0100

#1526164 — [PATCH urgent] x86/traps: Ignore high word of regs->cs in early_fixup_exception()

On the 80486 DX, it seems that some exceptions may leave garbage in
the high bits of CS.  This causes sporadic failures in which
early_fixup_exception() refuses to fix up an exception.

As far as I can tell, this has been buggy for a long time, but the
problem seems to have been exacerbated by commit 1e02ce4cccdc ("x86:
Store a per-cpu shadow copy of CR4") and commit e1bfc11c5a6f
("x86/init: Fix cr4_init_shadow() on CR4-less machines").

This appears to have broken for as long as we've had early
exception handling.

Stable maintainers: This patch is needed all the way back to 3.4,
but it will only apply to 4.6 and up, as it depends on commit
0e861fbb5bda ("x86/head: Move early exception panic code into
early_fixup_exception()").  If you want to backport to kernels
before 4.6, please don't backport the prerequisites (there was a big
chain of them that rewrote a lot of the early exception machinery);
instead, ask me and I can send you a one-liner that will apply.

Fixes: 4c5023a3fa2e ("x86-32: Handle exception table entries during early boot")
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: stable@vger.kernel.org
Reported-by: Matthew Whitehead <tedheadster@gmail.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---

This is for 4.9 because it makes it boot on some old 486 machines that it
can't currently reliably boot on.

I suspect we have many instances of similar bugs, and it would be nice
to fix them for real.

 arch/x86/mm/extable.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index 79ae939970d3..fcd06f7526de 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -135,7 +135,12 @@ void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
 	if (early_recursion_flag > 2)
 		goto halt_loop;
 
-	if (regs->cs != __KERNEL_CS)
+	/*
+	 * Old CPUs leave the high bits of CS on the stack
+	 * undefined.  I'm not sure which CPUs do this, but at least
+	 * the 486 DX works this way.
+	 */
+	if ((regs->cs & 0xFFFF) != __KERNEL_CS)
 		goto fail;
 
 	/*
-- 
2.7.4

[toc] | [next] | [standalone]

#1526434 — [tip:x86/urgent] x86/traps: Ignore high word of regs->cs in early_fixup_exception()

Commit-ID:  fc0e81b2bea0ebceb71889b61d2240856141c9ee
Gitweb:     http://git.kernel.org/tip/fc0e81b2bea0ebceb71889b61d2240856141c9ee
Author:     Andy Lutomirski <luto@kernel.org>
AuthorDate: Sat, 19 Nov 2016 18:42:40 -0800
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Mon, 21 Nov 2016 08:06:54 +0100

x86/traps: Ignore high word of regs->cs in early_fixup_exception()

On the 80486 DX, it seems that some exceptions may leave garbage in
the high bits of CS.  This causes sporadic failures in which
early_fixup_exception() refuses to fix up an exception.

As far as I can tell, this has been buggy for a long time, but the
problem seems to have been exacerbated by commits:

  1e02ce4cccdc ("x86: Store a per-cpu shadow copy of CR4")
  e1bfc11c5a6f ("x86/init: Fix cr4_init_shadow() on CR4-less machines")

This appears to have broken for as long as we've had early
exception handling.

[ Note to stable maintainers: This patch is needed all the way back to 3.4,
  but it will only apply to 4.6 and up, as it depends on commit:

    0e861fbb5bda ("x86/head: Move early exception panic code into early_fixup_exception()")

  If you want to backport to kernels before 4.6, please don't backport the
  prerequisites (there was a big chain of them that rewrote a lot of the
  early exception machinery); instead, ask me and I can send you a one-liner
  that will apply. ]

Reported-by: Matthew Whitehead <tedheadster@gmail.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Fixes: 4c5023a3fa2e ("x86-32: Handle exception table entries during early boot")
Link: http://lkml.kernel.org/r/cb32c69920e58a1a58e7b5cad975038a69c0ce7d.1479609510.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/mm/extable.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index 79ae939..fcd06f7 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -135,7 +135,12 @@ void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
 	if (early_recursion_flag > 2)
 		goto halt_loop;
 
-	if (regs->cs != __KERNEL_CS)
+	/*
+	 * Old CPUs leave the high bits of CS on the stack
+	 * undefined.  I'm not sure which CPUs do this, but at least
+	 * the 486 DX works this way.
+	 */
+	if ((regs->cs & 0xFFFF) != __KERNEL_CS)
 		goto fail;
 
 	/*

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web