The p_md.md_regs member of proc is used in signal handling to reference

the the original trapframe of the syscall, trap, or interrupt that entered
the kernel.  Before SMPng, ast's were handled via a psuedo trap at the
end of doerti.  With the SMPng commit, ast's were broken out into a
separate ast() function that was called from doreti to match the behavior
of other architectures.  Unfortunately, when this was done, the
p_md.md_regs member of curproc was not updateda in ast(), thus when
signals are handled by userret() after an interrupt that returns to
userland, we end up using a stale trapframe that will result in the
registers from the old trapframe overwriting the real trapframe and
smashing all the registers right before we return to usermode.  The saved
%cs:%eip from where we were in usermode are saved in the trapframe for
example.

1 files changed, 1 insertions, 0 deletions

diff --git a/sys/kern/subr_trap.c b/sys/kern/subr_trap.c
index 820ffca0958a..b418c0497366 100644
--- a/sys/kern/subr_trap.c
+++ b/sys/kern/subr_trap.c
@@ -1289,6 +1289,7 @@ ast(framep)
 	}
 
 	sticks = p->p_sticks;
+	p->p_md.md_regs = framep;
 
 	astoff(p);
 	cnt.v_soft++;