Skip to content
Commit 47a84f27 authored by Mathias Krause's avatar Mathias Krause Committed by Sean Christopherson
Browse files

x86/run_in_user: Reload SS after successful return



Complement commit 663f9e44 ("x86: Fix a #GP from occurring in
usermode library's exception handlers") and restore SS on a regular
return as well.

The INT-based "syscall" will make it get loaded with the NULL selector
(see SDM Vol. 1, Interrupt and Exception Behavior in 64-Bit Mode: "The
new SS is set to NULL if there is a change in CPL.") which reduces the
coverage provided by emulator64.c's "mov null, %%ss" test, as SS is
already loaded with the NULL selector.

Fix this by loading SS with KERNEL_DS after a successful userland
function call as well, as we already do in case of exceptions.

Signed-off-by: default avatarMathias Krause <minipli@grsecurity.net>
Link: https://lore.kernel.org/r/20230413184219.36404-10-minipli@grsecurity.net


[sean: use "rm" constraint, rephrase impact on emulator64's test]
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent 318f89e7
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment