Re: What exactly do 32-bit x86 exceptions push on the stack in the CS slot?

From: Andy Lutomirski
Date: Thu Nov 24 2016 - 12:17:06 EST

On Mon, Nov 21, 2016 at 1:21 PM, Linus Torvalds
<torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
> On Mon, Nov 21, 2016 at 10:26 AM, H. Peter Anvin <hpa@xxxxxxxxx> wrote:
>> On 11/21/16 10:00, Linus Torvalds wrote:
>>> I'd much rather we go back to just making the "cs" entry explicitly
>>> 16-bit, and have a separate padding entry, the way we used to long
>>> long ago.
>> I would agree 100% with this.
> We _used_ to do it like this in some places (signal stack, other places):
> unsigned short cs, __csh;

I'm testing a patch to do exactly this. I didn't bother with the
fancy anonymous union stuff because I don't see any great reason that
anything needs to write the high bits.

Amusingly, grsecurity seems to contain a fix for one instance of this
bug on x86_32 and one instance on x86_64 (!).