Commit dbe3ed1c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

x86-64: page faults from user mode are always user faults

Randy Dunlap noticed an interesting "crashme" behaviour on his dual
Prescott Xeon setup, where he gets page faults with the error code
having a zero "user" bit, but the register state points back to user

This may be a CPU microcode buglet triggered by some strange instruction
pattern that crashme generates, and loading a microcode update seems to
possibly have fixed it.

Regardless, we really should trust the register state more than the
error code, since it's really the register state that determines whether
we can actually send a signal, or whether we're in kernel mode and need
to oops/kill the process in the case of a page fault.

Cc: Randy Dunlap <>
Signed-off-by: default avatarLinus Torvalds <>
parent 4f01a757
......@@ -374,6 +374,13 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
if (unlikely(in_atomic() || !mm))
goto bad_area_nosemaphore;
* User-mode registers count as a user access even for any
* potential system fault or CPU buglet.
if (user_mode_vm(regs))
error_code |= PF_USER;
/* When running in the kernel we expect faults to occur only to
* addresses in user space. All other faults represent errors in the
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment