Re: What exactly do 32-bit x86 exceptions push on the stack in the CS slot?

[Andy Lutomirski]

On Mon, Nov 21, 2016 at 1:21 PM, Linus Torvalds
<torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
> On Mon, Nov 21, 2016 at 10:26 AM, H. Peter Anvin <hpa@xxxxxxxxx> wrote:
>> On 11/21/16 10:00, Linus Torvalds wrote:
>>>
>>> I'd much rather we go back to just making the "cs" entry explicitly
>>> 16-bit, and have a separate padding entry, the way we used to long
>>> long ago.
>>>
>>
>> I would agree 100% with this.
>
> We _used_ to do it like this in some places (signal stack, other places):
>
>     unsigned short  cs, __csh;

I'm testing a patch to do exactly this.  I didn't bother with the
fancy anonymous union stuff because I don't see any great reason that
anything needs to write the high bits.

Amusingly, grsecurity seems to contain a fix for one instance of this
bug on x86_32 and one instance on x86_64 (!).

--Andy