[44/98] x86-64: Clear a 64-bit FS/GS base on fork if selector is nonzero
in [Kernel]
|
Prev: [73/98] r8169: more broken register writes workaround
Next: [29/98] ocfs2_dlmfs: Fix math error when reading LVB.
From: Greg KH on 10 May 2010 19:10 2.6.32-stable review patch. If anyone has any objections, please let us know. ------------------ From: H. Peter Anvin <hpa(a)zytor.com> commit 7ce5a2b9bb2e92902230e3121d8c3047fab9cb47 upstream. When we do a thread switch, we clear the outgoing FS/GS base if the corresponding selector is nonzero. This is taken by __switch_to() as an entry invariant; it does not verify that it is true on entry. However, copy_thread() doesn't enforce this constraint, which can result in inconsistent results after fork(). Make copy_thread() match the behavior of __switch_to(). Reported-and-tested-by: Samuel Thibault <samuel.thibault(a)inria.fr> Signed-off-by: H. Peter Anvin <hpa(a)zytor.com> LKML-Reference: <4BD1E061.8030605(a)zytor.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de> --- arch/x86/kernel/process_64.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/arch/x86/kernel/process_64.c +++ b/arch/x86/kernel/process_64.c @@ -295,11 +295,10 @@ int copy_thread(unsigned long clone_flag set_tsk_thread_flag(p, TIF_FORK); - p->thread.fs = me->thread.fs; - p->thread.gs = me->thread.gs; - savesegment(gs, p->thread.gsindex); + p->thread.gs = p->thread.gsindex ? 0 : me->thread.gs; savesegment(fs, p->thread.fsindex); + p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs; savesegment(es, p->thread.es); savesegment(ds, p->thread.ds); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |