Patch "x86/traps: Ignore high word of regs->cs in early_fixup_exception()" has been added to the 4.8-stable tree

This is a note to let you know that I've just added the patch titled

    x86/traps: Ignore high word of regs->cs in early_fixup_exception()

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-traps-ignore-high-word-of-regs-cs-in-early_fixup_exception.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andy Lutomirski <[email protected]>
Date: Sat, 19 Nov 2016 18:42:40 -0800
Subject: x86/traps: Ignore high word of regs->cs in early_fixup_exception()

From: Andy Lutomirski <[email protected]>

commit fc0e81b2bea0ebceb71889b61d2240856141c9ee upstream.

On the 80486 DX, it seems that some exceptions may leave garbage in the high bits of CS. This causes sporadic failures in which early_fixup_exception() refuses to fix up an exception.

As far as I can tell, this has been buggy for a long time, but the problem seems to have been exacerbated by commits:

1e02ce4cccdc ("x86: Store a per-cpu shadow copy of CR4") e1bfc11c5a6f ("x86/init: Fix cr4_init_shadow() on CR4-less machines")

This appears to have broken for as long as we've had early exception handling.

[ Note to stable maintainers: This patch is needed all the way back to 3.4,
but it will only apply to 4.6 and up, as it depends on commit:

0e861fbb5bda ("x86/head: Move early exception panic code into early_fixup_exception()")

If you want to backport to kernels before 4.6, please don't backport the prerequisites (there was a big chain of them that rewrote a lot of the early exception machinery); instead, ask me and I can send you a one-liner that will apply. ]

---
 arch/x86/mm/extable.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -135,7 +135,12 @@ void __init early_fixup_exception(struct
 	if (early_recursion_flag > 2)
 		goto halt_loop;
 
-	if (regs->cs != __KERNEL_CS)
+	/*
+	 * Old CPUs leave the high bits of CS on the stack
+	 * undefined.  I'm not sure which CPUs do this, but at least
+	 * the 486 DX works this way.
+	 */
+	if ((regs->cs & 0xFFFF) != __KERNEL_CS)
 		goto fail;
 
 	/*

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/x86-fpu-fix-invalid-fpu-ptrace-state-after-execve.patch queue-4.8/x86-traps-ignore-high-word-of-regs-cs-in-early_fixup_exception.patch