Messages in this thread Patch in this message | | | Date | Tue, 14 Aug 2007 14:31:19 -0400 | From | Chuck Anderson <> | Subject | vm86.c audit_syscall_exit() call trashes registers |
| |
Please Cc: any replies, as we are not subscribed to linux-kernel. Thanks.
Somewhere around 2.6.16.12 a call to audit_syscall_exit was added to vm86.c:
static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk) { struct tss_struct *tss; + long eax; /* * make sure the vm86() system call doesn't try to do anything silly */ @@ -305,13 +307,19 @@ static void do_sys_vm86(struct kernel_vm tsk->thread.screen_bitmap = info->screen_bitmap; if (info->flags & VM86_SCREEN_BITMAP) mark_screen_rdonly(tsk->mm); + __asm__ __volatile__("xorl %eax,%eax; movl %eax,%fs; movl %eax,%gs\n\t"); + __asm__ __volatile__("movl %%eax, %0\n" :"=r"(eax)); + + /*call audit_syscall_exit since we do not exit via the normal paths */ + if (unlikely(current->audit_context)) + audit_syscall_exit(current, AUDITSC_RESULT(eax), eax); + __asm__ __volatile__( - "xorl %%eax,%%eax; movl %%eax,%%fs; movl %%eax,%%gs\n\t" "movl %0,%%esp\n\t" "movl %1,%%ebp\n\t" "jmp resume_userspace" : /* no outputs */ - :"r" (&info->regs), "r" (task_thread_info(tsk)) : "ax"); + :"r" (&info->regs), "r" (task_thread_info(tsk))); /* we never return here */ } This appears to have caused intermittent data corruption of the results of the vm86() call that the X server uses to get EDID data from the monitor via the VESA BIOS. After removing the audit_syscall_exit() call, the problems mentioned in these bugzillas disappear: Fetch of EDID 128 byte buffer by X server through vm86 INT 10 call is flaky. http://bugzilla.kernel.org/show_bug.cgi?id=8633
RHEL 5 fails to get EDID data from monitor and sets low resolution https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236416
If I'm reading correctly, it appears that the code above trashes the %fs and %gs registers, or otherwise doesn't leave them at zero before returning from the system call as the old code did. Is this a correct analysis? How should this be fixed?
Thanks.
-Chuck - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |