That's true. The xss and esp fields of the pt_regs struct always contain
either garbage (for interrupts occuring while in kernel mode) or
user-mode values (for interrupts occuring while in user mode).
So, filling these fields with kernel-mode values indeed doesn't make
much sense.
Allocating space on the stack and poisoning those values would make
sense, though, so I will modify the patch accordingly and resend it.
Thank you for your feedback!
- Philipp Kohlbecher
-