1 files changed, 10 insertions, 18 deletions

diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index 8538bfea30e6..c946e4fe67a7 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -180,6 +180,10 @@ rff_trace:
  *
  * XXX  if we had a free scratch register we could save the RSP into the stack frame
  *      and report it properly in ps. Unfortunately we haven't.
+ *
+ * When user can change the frames always force IRET. That is because
+ * it deals with uncanonical addresses better. SYSRET has trouble
+ * with them due to bugs in both AMD and Intel CPUs.
  */                                     
 
 ENTRY(system_call)
@@ -254,7 +258,10 @@ sysret_signal:
         xorl %esi,%esi # oldset -> arg2
         call ptregscall_common
 1:      movl $_TIF_NEED_RESCHED,%edi
-        jmp sysret_check
+        /* Use IRET because user could have changed frame. This
+           works because ptregscall_common has called FIXUP_TOP_OF_STACK. */
+        cli
+        jmp int_with_check
         
 badsys:
         movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
@@ -280,7 +287,8 @@ tracesys:
         call syscall_trace_leave
         RESTORE_TOP_OF_STACK %rbx
         RESTORE_REST
-        jmp ret_from_sys_call
+        /* Use IRET because user could have changed frame */
+        jmp int_ret_from_sys_call
         CFI_ENDPROC
                 
 /* 
@@ -408,25 +416,9 @@ ENTRY(stub_execve)
         CFI_ADJUST_CFA_OFFSET -8
         CFI_REGISTER rip, r11
         SAVE_REST
-        movq %r11, %r15
-        CFI_REGISTER rip, r15
         FIXUP_TOP_OF_STACK %r11
         call sys_execve
-        GET_THREAD_INFO(%rcx)
-        bt $TIF_IA32,threadinfo_flags(%rcx)
-        CFI_REMEMBER_STATE
-        jc exec_32bit
         RESTORE_TOP_OF_STACK %r11
-        movq %r15, %r11
-        CFI_REGISTER rip, r11
-        RESTORE_REST
-        pushq %r11
-        CFI_ADJUST_CFA_OFFSET 8
-        CFI_REL_OFFSET rip, 0
-        ret
-
-exec_32bit:
-        CFI_RESTORE_STATE
         movq %rax,RAX(%rsp)
         RESTORE_REST
         jmp int_ret_from_sys_call