CHROMIUM: x86: alt-syscall: Fix syscall limit check

nr_syscalls and ia32_nr_syscalls are 32-bit values, but a cmpq will do
an 8-byte load resulting in the upper 32-bits being undefined.  Do a
32-bit load of the syscall limit into a temporary register first, and
then do the comparison against RAX (syscall number).

BUG=b:25649436
TEST=security_SandboxLinuxUnittests now passes on x86.

Change-Id: Ia71c7dbb8a08dcc3f9169c5800ca03b8b9f248b8
[abrestic: squashed semenzato@'s fix from CL:319605]
Signed-off-by: Andrew Bresticker <abrestic@chromium.org>
Signed-off-by: Luigi Semenzato <semenzato@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/321143

arch/x86/ia32/ia32entry.S

@@ -166,7 +166,8 @@ sysenter_flags_fixed:
 	CFI_REMEMBER_STATE
 	jnz  sysenter_tracesys
 #ifdef CONFIG_ALT_SYSCALL
-	cmpq	TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl	TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq	%r11,%rax
 	jae	ia32_badsys
 #else
 	cmpq	$(IA32_NR_syscalls-1),%rax
@@ -217,7 +218,8 @@ sysexit_from_sys_call:
 	call __audit_syscall_entry
 	movl RAX-ARGOFFSET(%rsp),%eax	/* reload syscall number */
 #ifdef CONFIG_ALT_SYSCALL
-	cmpq TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq %r11,%rax
 	jae ia32_badsys
 #else
 	cmpq $(IA32_NR_syscalls-1),%rax
@@ -279,7 +281,8 @@ sysenter_tracesys:
 	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
 	RESTORE_REST
 #ifdef CONFIG_ALT_SYSCALL
-	cmpq	TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl	TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq	%r11,%rax
 	jae	int_ret_from_sys_call
 #else
 	cmpq	$(IA32_NR_syscalls-1),%rax
@@ -349,7 +352,8 @@ ENTRY(ia32_cstar_target)
 	CFI_REMEMBER_STATE
 	jnz   cstar_tracesys
 #ifdef CONFIG_ALT_SYSCALL
-	cmpq TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq %r11,%rax
 	jae  ia32_badsys
 #else
 	cmpq $IA32_NR_syscalls-1,%rax
@@ -411,7 +415,8 @@ cstar_tracesys:
 	RESTORE_REST
 	xchgl %ebp,%r9d
 #ifdef CONFIG_ALT_SYSCALL
-	cmpq TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq %r11,%rax
 	jae int_ret_from_sys_call
 #else
 	cmpq $(IA32_NR_syscalls-1),%rax
@@ -473,7 +478,8 @@ ENTRY(ia32_syscall)
 	testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
 	jnz ia32_tracesys
 #ifdef CONFIG_ALT_SYSCALL
-	cmpq TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq %r11,%rax
 	jae ia32_badsys
 #else
 	cmpq $(IA32_NR_syscalls-1),%rax
@@ -502,7 +508,8 @@ ia32_tracesys:
 	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
 	RESTORE_REST
 #ifdef CONFIG_ALT_SYSCALL
-	cmpq TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl TI_ia32_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq %r11,%rax
 	jae  int_ret_from_sys_call
 #else
 	cmpq $(IA32_NR_syscalls-1),%rax

arch/x86/kernel/entry_64.S

@@ -413,7 +413,8 @@ GLOBAL(system_call_after_swapgs)
 system_call_fastpath:
 #if __SYSCALL_MASK == ~0
 # ifdef CONFIG_ALT_SYSCALL
-	cmpq TI_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl TI_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq %r11,%rax
 	jae ret_from_sys_call
 # else
 	cmpq $__NR_syscall_max,%rax
@@ -535,7 +536,8 @@ tracesys_phase2:
 	RESTORE_REST
 #if __SYSCALL_MASK == ~0
 # ifdef CONFIG_ALT_SYSCALL
-	cmpq TI_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%rax
+	movl TI_nr_syscalls+THREAD_INFO(%rsp,RIP-ARGOFFSET),%r11d
+	cmpq %r11,%rax
 	jae  int_ret_from_sys_call
 # else
 	cmpq $__NR_syscall_max,%rax