1 files changed, 32 insertions, 21 deletions

diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 1a1ae8edc40c..fec79ad85dc6 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -11,6 +11,7 @@
 
 #include <stdarg.h>
 
+#include <linux/stackprotector.h>
 #include <linux/cpu.h>
 #include <linux/errno.h>
 #include <linux/sched.h>
@@ -91,6 +92,15 @@ void cpu_idle(void)
 {
         int cpu = smp_processor_id();
 
+        /*
+         * If we're the non-boot CPU, nothing set the stack canary up
+         * for us.  CPU0 already has it initialized but no harm in
+         * doing it again.  This is a good place for updating it, as
+         * we wont ever return from this function (so the invalid
+         * canaries already on the stack wont ever trigger).
+         */
+        boot_init_stack_canary();
+
         current_thread_info()->status |= TS_POLLING;
 
         /* endless idle loop with no priority at all */
@@ -131,7 +141,7 @@ void __show_regs(struct pt_regs *regs, int all)
         if (user_mode_vm(regs)) {
                 sp = regs->sp;
                 ss = regs->ss & 0xffff;
-                savesegment(gs, gs);
+                gs = get_user_gs(regs);
         } else {
                 sp = (unsigned long) (&regs->sp);
                 savesegment(ss, ss);
@@ -212,6 +222,7 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
         regs.ds = __USER_DS;
         regs.es = __USER_DS;
         regs.fs = __KERNEL_PERCPU;
+        regs.gs = __KERNEL_STACK_CANARY;
         regs.orig_ax = -1;
         regs.ip = (unsigned long) kernel_thread_helper;
         regs.cs = __KERNEL_CS | get_kernel_rpl();
@@ -304,7 +315,7 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
 
         p->thread.ip = (unsigned long) ret_from_fork;
 
-        savesegment(gs, p->thread.gs);
+        task_user_gs(p) = get_user_gs(regs);
 
         tsk = current;
         if (unlikely(test_tsk_thread_flag(tsk, TIF_IO_BITMAP))) {
@@ -342,7 +353,7 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
 void
 start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
 {
-        __asm__("movl %0, %%gs" : : "r"(0));
+        set_user_gs(regs, 0);
         regs->fs                = 0;
         set_fs(USER_DS);
         regs->ds                = __USER_DS;
@@ -539,7 +550,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
          * used %fs or %gs (it does not today), or if the kernel is
          * running inside of a hypervisor layer.
          */
-        savesegment(gs, prev->gs);
+        lazy_save_gs(prev->gs);
 
         /*
          * Load the per-thread Thread-Local Storage descriptor.
@@ -585,31 +596,31 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
          * Restore %gs if needed (which is common)
          */
         if (prev->gs | next->gs)
-                loadsegment(gs, next->gs);
+                lazy_load_gs(next->gs);
 
         percpu_write(current_task, next_p);
 
         return prev_p;
 }
 
-asmlinkage int sys_fork(struct pt_regs regs)
+int sys_fork(struct pt_regs *regs)
 {
-        return do_fork(SIGCHLD, regs.sp, &regs, 0, NULL, NULL);
+        return do_fork(SIGCHLD, regs->sp, regs, 0, NULL, NULL);
 }
 
-asmlinkage int sys_clone(struct pt_regs regs)
+int sys_clone(struct pt_regs *regs)
 {
         unsigned long clone_flags;
         unsigned long newsp;
         int __user *parent_tidptr, *child_tidptr;
 
-        clone_flags = regs.bx;
-        newsp = regs.cx;
-        parent_tidptr = (int __user *)regs.dx;
-        child_tidptr = (int __user *)regs.di;
+        clone_flags = regs->bx;
+        newsp = regs->cx;
+        parent_tidptr = (int __user *)regs->dx;
+        child_tidptr = (int __user *)regs->di;
         if (!newsp)
-                newsp = regs.sp;
-        return do_fork(clone_flags, newsp, &regs, 0, parent_tidptr, child_tidptr);
+                newsp = regs->sp;
+        return do_fork(clone_flags, newsp, regs, 0, parent_tidptr, child_tidptr);
 }
 
 /*
@@ -622,27 +633,27 @@ asmlinkage int sys_clone(struct pt_regs regs)
  * do not have enough call-clobbered registers to hold all
  * the information you need.
  */
-asmlinkage int sys_vfork(struct pt_regs regs)
+int sys_vfork(struct pt_regs *regs)
 {
-        return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, regs.sp, &regs, 0, NULL, NULL);
+        return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, regs->sp, regs, 0, NULL, NULL);
 }
 
 /*
  * sys_execve() executes a new program.
  */
-asmlinkage int sys_execve(struct pt_regs regs)
+int sys_execve(struct pt_regs *regs)
 {
         int error;
         char *filename;
 
-        filename = getname((char __user *) regs.bx);
+        filename = getname((char __user *) regs->bx);
         error = PTR_ERR(filename);
         if (IS_ERR(filename))
                 goto out;
         error = do_execve(filename,
-                        (char __user * __user *) regs.cx,
-                        (char __user * __user *) regs.dx,
-                        &regs);
+                        (char __user * __user *) regs->cx,
+                        (char __user * __user *) regs->dx,
+                        regs);
         if (error == 0) {
                 /* Make sure we don't return using sysenter.. */
                 set_thread_flag(TIF_IRET);