1. 24 6月, 2005 2 次提交
  2. 06 5月, 2005 1 次提交
    • A
      [PATCH] x86 stack initialisation fix · f48d9663
      Alexander Nyberg 提交于
      The recent change fix-crash-in-entrys-restore_all.patch
      
       	childregs->esp = esp;
      
       	p->thread.esp = (unsigned long) childregs;
      -	p->thread.esp0 = (unsigned long) (childregs+1);
      +	p->thread.esp0 = (unsigned long) (childregs+1) - 8;
      
       	p->thread.eip = (unsigned long) ret_from_fork;
      
      introduces an inconsistency between esp and esp0 before the task is run the
      first time.  esp0 is no longer the actual start of the stack, but 8 bytes
      off.
      
      This shows itself clearly in a scenario when a ptracer that is set to also
      ptrace eventual children traces program1 which then clones thread1.  Now
      the ptracer wants to modify the registers of thread1.  The x86 ptrace
      implementation bases it's knowledge about saved user-space registers upon
      p->thread.esp0.  But this will be a few bytes off causing certain writes to
      the kernel stack to overwrite a saved kernel function address making the
      kernel when actually running thread1 jump out into user-space.  Very
      spectacular.
      
      The testcase I've used is:
      /* start with strace -f ./a.out */
      #include <pthread.h>
      #include <stdio.h>
      
      void *do_thread(void *p)
      {
      	for (;;);
      }
      
      int main()
      {
      	pthread_t one;
      	pthread_create(&one, NULL, &do_thread, NULL);
      	for (;;);
      	return 0;
      }
      
      So, my solution is to instead of just adjusting esp0 that creates an
      inconsitent state I adjust where the user-space registers are saved with -8
      bytes.  This gives us the wanted extra bytes on the start of the stack and
      esp0 is now correct.  This solves the issues I saw from the original
      testcase from Mateusz Berezecki and has survived testing here.  I think
      this should go into -mm a round or two first however as there might be some
      cruft around depending on pt_regs lying on the start of the stack.  That
      however would have broken with the first change too!
      
      It's actually a 2-line diff but I had to move the comment of why the -8 bytes
      are there a few lines up. Thanks to Zwane for helping me with this.
      Signed-off-by: NAlexander Nyberg <alexn@telia.com>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      f48d9663
  3. 01 5月, 2005 1 次提交
    • H
      [PATCH] i386/x86_64 segment register access update · fd51f666
      H. J. Lu 提交于
      The new i386/x86_64 assemblers no longer accept instructions for moving
      between a segment register and a 32bit memory location, i.e.,
      
              movl (%eax),%ds
              movl %ds,(%eax)
      
      To generate instructions for moving between a segment register and a
      16bit memory location without the 16bit operand size prefix, 0x66,
      
              mov (%eax),%ds
              mov %ds,(%eax)
      
      should be used. It will work with both new and old assemblers. The
      assembler starting from 2.16.90.0.1 will also support
      
              movw (%eax),%ds
              movw %ds,(%eax)
      
      without the 0x66 prefix. I am enclosing patches for 2.4 and 2.6 kernels
      here. The resulting kernel binaries should be unchanged as before, with
      old and new assemblers, if gcc never generates memory access for
      
                     unsigned gsindex;
                     asm volatile("movl %%gs,%0" : "=g" (gsindex));
      
      If gcc does generate memory access for the code above, the upper bits
      in gsindex are undefined and the new assembler doesn't allow it.
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      fd51f666
  4. 17 4月, 2005 3 次提交
    • R
      [PATCH] i386: Use loaddebug macro consistently · ecd02ddd
      Roland McGrath 提交于
      This moves the macro loaddebug from asm-i386/suspend.h to
      asm-i386/processor.h, which is the place that makes sense for it to be
      defined, removes the extra copy of the same macro in
      arch/i386/kernel/process.c, and makes arch/i386/kernel/signal.c use the
      macro in place of its expansion.
      
      This is a purely cosmetic cleanup for the normal i386 kernel.  However, it
      is handy for Xen to be able to just redefine the loaddebug macro once
      instead of also changing the signal.c code.
      Signed-off-by: NRoland McGrath <roland@redhat.com>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      ecd02ddd
    • S
      [PATCH] fix crash in entry.S restore_all · 5df24082
      Stas Sergeev 提交于
      Fix the access-above-bottom-of-stack crash.
      
      1. Allows to preserve the valueable optimization
      
      2. Works for NMIs
      
      3.  Doesn't care whether or not there are more of the like instances
         where the stack is left empty.
      
      4. Seems to work for me without the crashes:) 
      
      (akpm: this is still under discussion, although I _think_ it's OK.  You might
      want to hold off)
      
      Signed-off-by: Stas Sergeev <stsp@aknet.ru> 
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      5df24082
    • L
      Linux-2.6.12-rc2 · 1da177e4
      Linus Torvalds 提交于
      Initial git repository build. I'm not bothering with the full history,
      even though we have it. We can create a separate "historical" git
      archive of that later if we want to, and in the meantime it's about
      3.2GB when imported into git - space that would just make the early
      git days unnecessarily complicated, when we don't have a lot of good
      infrastructure for it.
      
      Let it rip!
      1da177e4