From: Peter Zijlstra <peterz@xxxxxxxxxxxxx> commit 1cd5f059d956e6f614ba6666ecdbcf95db05d5f5 upstream. Paolo reported that the instruction sequence that is used to replace: call __static_call_return0 namely: 66 66 48 31 c0 data16 data16 xor %rax,%rax decodes to something else on i386, namely: 66 66 48 data16 dec %ax 31 c0 xor %eax,%eax Which is a nonsensical sequence that happens to have the same outcome. *However* an important distinction is that it consists of 2 instructions which is a problem when the thing needs to be overwriten with a regular call instruction again. As such, replace the instruction with something that decodes the same on both i386 and x86_64. Fixes: 3f2a8fc4b15d ("static_call/x86: Add __static_call_return0()") Reported-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx> Link: https://lkml.kernel.org/r/20220318204419.GT8939@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/x86/kernel/static_call.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/arch/x86/kernel/static_call.c +++ b/arch/x86/kernel/static_call.c @@ -12,10 +12,9 @@ enum insn_type { }; /* - * data16 data16 xorq %rax, %rax - a single 5 byte instruction that clears %rax - * The REX.W cancels the effect of any data16. + * cs cs cs xorl %eax, %eax - a single 5 byte instruction that clears %[er]ax */ -static const u8 xor5rax[] = { 0x66, 0x66, 0x48, 0x31, 0xc0 }; +static const u8 xor5rax[] = { 0x2e, 0x2e, 0x2e, 0x31, 0xc0 }; static const u8 retinsn[] = { RET_INSN_OPCODE, 0xcc, 0xcc, 0xcc, 0xcc }; Patches currently in stable-queue which might be from peterz@xxxxxxxxxxxxx are queue-5.17/sched-core-fix-forceidle-balancing.patch queue-5.17/perf-x86-intel-update-the-frontend-msr-mask-on-sapphire-rapids.patch queue-5.17/x86-bug-prevent-shadowing-in-__warn_flags.patch queue-5.17/x86-extable-prefer-local-labels-in-.set-directives.patch queue-5.17/perf-core-inherit-event_caps.patch queue-5.17/x86-kconfig-do-not-allow-config_x86_x32_abi-y-with-l.patch queue-5.17/perf-x86-intel-don-t-extend-the-pseudo-encoding-to-gp-counters.patch queue-5.17/x86-static_call-fix-__static_call_return0-for-i386.patch queue-5.17/sched-teach-the-forced-newidle-balancer-about-cpu-affinity-limitation.patch queue-5.17/powerpc-code-patching-pre-map-patch-area.patch queue-5.17/x86-annotate-call_on_stack.patch queue-5.17/objtool-fix-sls-validation-for-kcov-tail-call-replacement.patch queue-5.17/highmem-fix-checks-in-__kmap_local_sched_-in-out.patch