4 files changed, 37 insertions, 20 deletions

diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S
index 32980b834935..a714d6b43506 100644
--- a/arch/i386/kernel/entry.S
+++ b/arch/i386/kernel/entry.S
@@ -409,8 +409,6 @@ restore_nocheck_notrace:
 1:      INTERRUPT_RETURN
 .section .fixup,"ax"
 iret_exc:
-        TRACE_IRQS_ON
-        ENABLE_INTERRUPTS(CLBR_NONE)
         pushl $0                        # no error code
         pushl $do_iret_error
         jmp error_code
diff --git a/arch/i386/kernel/ptrace.c b/arch/i386/kernel/ptrace.c
index 1c075f58d1f9..0c8f00e69c4d 100644
--- a/arch/i386/kernel/ptrace.c
+++ b/arch/i386/kernel/ptrace.c
@@ -164,14 +164,22 @@ static unsigned long convert_eip_to_linear(struct task_struct *child, struct pt_
                 u32 *desc;
                 unsigned long base;
 
-                down(&child->mm->context.sem);
-                desc = child->mm->context.ldt + (seg & ~7);
-                base = (desc[0] >> 16) | ((desc[1] & 0xff) << 16) | (desc[1] & 0xff000000);
+                seg &= ~7UL;
 
-                /* 16-bit code segment? */
-                if (!((desc[1] >> 22) & 1))
-                        addr &= 0xffff;
-                addr += base;
+                down(&child->mm->context.sem);
+                if (unlikely((seg >> 3) >= child->mm->context.size))
+                        addr = -1L; /* bogus selector, access would fault */
+                else {
+                        desc = child->mm->context.ldt + seg;
+                        base = ((desc[0] >> 16) |
+                                ((desc[1] & 0xff) << 16) |
+                                (desc[1] & 0xff000000));
+
+                        /* 16-bit code segment? */
+                        if (!((desc[1] >> 22) & 1))
+                                addr &= 0xffff;
+                        addr += base;
+                }
                 up(&child->mm->context.sem);
         }
         return addr;
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index 18c1c285836d..d32fd4b6f78e 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -518,10 +518,12 @@ fastcall void do_##name(struct pt_regs * regs, long error_code) \
         do_trap(trapnr, signr, str, 0, regs, error_code, NULL); \
 }
 
-#define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr) \
+#define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr, irq) \
 fastcall void do_##name(struct pt_regs * regs, long error_code) \
 { \
         siginfo_t info; \
+        if (irq) \
+                local_irq_enable(); \
         info.si_signo = signr; \
         info.si_errno = 0; \
         info.si_code = sicode; \
@@ -561,13 +563,13 @@ DO_VM86_ERROR( 3, SIGTRAP, "int3", int3)
 #endif
 DO_VM86_ERROR( 4, SIGSEGV, "overflow", overflow)
 DO_VM86_ERROR( 5, SIGSEGV, "bounds", bounds)
-DO_ERROR_INFO( 6, SIGILL,  "invalid opcode", invalid_op, ILL_ILLOPN, regs->eip)
+DO_ERROR_INFO( 6, SIGILL,  "invalid opcode", invalid_op, ILL_ILLOPN, regs->eip, 0)
 DO_ERROR( 9, SIGFPE,  "coprocessor segment overrun", coprocessor_segment_overrun)
 DO_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
 DO_ERROR(11, SIGBUS,  "segment not present", segment_not_present)
 DO_ERROR(12, SIGBUS,  "stack segment", stack_segment)
-DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0)
-DO_ERROR_INFO(32, SIGSEGV, "iret exception", iret_error, ILL_BADSTK, 0)
+DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0, 0)
+DO_ERROR_INFO(32, SIGSEGV, "iret exception", iret_error, ILL_BADSTK, 0, 1)
 
 fastcall void __kprobes do_general_protection(struct pt_regs * regs,
                                               long error_code)
diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c
index fa6775ef729f..e83cc67155ac 100644
--- a/arch/x86_64/kernel/ptrace.c
+++ b/arch/x86_64/kernel/ptrace.c
@@ -102,16 +102,25 @@ unsigned long convert_rip_to_linear(struct task_struct *child, struct pt_regs *r
                 u32 *desc;
                 unsigned long base;
 
-                down(&child->mm->context.sem);
-                desc = child->mm->context.ldt + (seg & ~7);
-                base = (desc[0] >> 16) | ((desc[1] & 0xff) << 16) | (desc[1] & 0xff000000);
+                seg &= ~7UL;
 
-                /* 16-bit code segment? */
-                if (!((desc[1] >> 22) & 1))
-                        addr &= 0xffff;
-                addr += base;
+                down(&child->mm->context.sem);
+                if (unlikely((seg >> 3) >= child->mm->context.size))
+                        addr = -1L; /* bogus selector, access would fault */
+                else {
+                        desc = child->mm->context.ldt + seg;
+                        base = ((desc[0] >> 16) |
+                                ((desc[1] & 0xff) << 16) |
+                                (desc[1] & 0xff000000));
+
+                        /* 16-bit code segment? */
+                        if (!((desc[1] >> 22) & 1))
+                                addr &= 0xffff;
+                        addr += base;
+                }
                 up(&child->mm->context.sem);
         }
+
         return addr;
 }