x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C

There's nothing special enough about the espfix64 double fault fixup to
justify writing it in assembly.  Move it to C.

This also fixes a bug: if the double fault came from an IST stack, the
old asm code would return to a partially uninitialized stack frame.

Fixes: 3891a04aafd668686239349ea58f3314ea2af86b
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 24 insertions, 0 deletions

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 0d0e922fafc1..819662746e23 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -259,6 +259,30 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
         static const char str[] = "double fault";
         struct task_struct *tsk = current;
 
+#ifdef CONFIG_X86_ESPFIX64
+        extern unsigned char native_irq_return_iret[];
+
+        /*
+         * If IRET takes a non-IST fault on the espfix64 stack, then we
+         * end up promoting it to a doublefault.  In that case, modify
+         * the stack to make it look like we just entered the #GP
+         * handler from user space, similar to bad_iret.
+         */
+        if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
+                regs->cs == __KERNEL_CS &&
+                regs->ip == (unsigned long)native_irq_return_iret)
+        {
+                struct pt_regs *normal_regs = task_pt_regs(current);
+
+                /* Fake a #GP(0) from userspace. */
+                memmove(&normal_regs->ip, (void *)regs->sp, 5*8);
+                normal_regs->orig_ax = 0;  /* Missing (lost) #GP error code */
+                regs->ip = (unsigned long)general_protection;
+                regs->sp = (unsigned long)&normal_regs->orig_ax;
+                return;
+        }
+#endif
+
         exception_enter();
         /* Return not checked because double check cannot be ignored */
         notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);