From 7815a905af39d7c19c83de1c2d4d5d888fd9e9c0 Mon Sep 17 00:00:00 2001 From: raiden00pl Date: Mon, 10 Aug 2026 15:58:58 +0200 Subject: [PATCH] arch/x86_64: align the user signal frame and skip the ABI red zone The signal frame was built inside the 128 byte red zone of the interrupted user code and inherited its stack alignment, so a leaf function could lose live data to the siginfo copy and the handler could fault on an SSE access. Build the frame below the red zone, 16 byte aligned; the naked trampoline calls the handler itself and its call provides the return address slot. Signed-off-by: raiden00pl Assisted-by: Claude Code --- arch/x86_64/src/common/x86_64_syscall.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/arch/x86_64/src/common/x86_64_syscall.c b/arch/x86_64/src/common/x86_64_syscall.c index d9dd921886e..e5684d50eb7 100644 --- a/arch/x86_64/src/common/x86_64_syscall.c +++ b/arch/x86_64/src/common/x86_64_syscall.c @@ -39,6 +39,14 @@ #include "x86_64_internal.h" +/**************************************************************************** + * Pre-processor Definitions + ****************************************************************************/ + +/* Red zone the System V AMD64 ABI reserves below the user stack pointer */ + +#define X86_64_ABI_RED_ZONE 128 + /**************************************************************************** * Private Types ****************************************************************************/ @@ -241,16 +249,18 @@ uint64_t *x86_64_syscall(uint64_t *regs) rtcb->xcp.kstkptr = (uintptr_t *)regs[REG_RSP]; - /* Copy "info" into user stack */ + /* Create a 16 byte aligned frame for info below the red + * zone of the interrupted user code + */ - usp = rtcb->xcp.saved_ursp - 8; - - /* Create a frame for info and copy the kernel info */ - - usp = usp - sizeof(siginfo_t); + usp = (rtcb->xcp.saved_ursp - X86_64_ABI_RED_ZONE - + sizeof(siginfo_t)) & ~0x0f; memcpy((void *)usp, (void *)regs[REG_RSI], sizeof(siginfo_t)); - /* Now set the updated SP and user copy of "info" to RSI */ + /* Set the new SP and the user copy of "info" to RSI. + * The naked trampoline is entered with SP 16 byte + * aligned; its call provides the return address slot. + */ regs[REG_RSP] = usp; regs[REG_RSI] = usp;