• Andi Kleen's avatar
    [PATCH] x86_64: When user could have changed RIP always force IRET · 7bf36bbc
    Andi Kleen authored
    Intel EM64T CPUs handle uncanonical return addresses differently
    from AMD CPUs.
    
    The exception is reported in the SYSRET, not the next instruction.
    This leads to the kernel exception handler running on the user stack
    with the wrong GS because the kernel didn't expect exceptions
    on this instruction.
    
    This version of the patch has the teething problems that plagued an earlier
    version fixed.
    
    This is CVE-2006-0744
    
    Thanks to Ernie Petrides and Asit B. Mallick for analysis and initial
    patches.
    Signed-off-by: default avatarAndi Kleen <ak@suse.de>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    7bf36bbc
entry.S 23.6 KB