@@ -1062,14 +1062,20 @@ SYM_CODE_START(error_entry)
/*
* If sandbox mode was active, adjust the saved CS,
* unconditionally switch to kernel CR3 and continue
- * as if the interrupt was from kernel space.
+ * as if the interrupt was from kernel space, but
+ * switch away from the trampoline stack.
*/
movq x86_sbm_state + SBM_kernel_cr3, %rcx
jrcxz .Lerror_swapgs
andb $~3, CS+8(%rsp)
movq %rcx, %cr3
- jmp .Lerror_entry_done_lfence
+
+ FENCE_SWAPGS_KERNEL_ENTRY
+ CALL_DEPTH_ACCOUNT
+ leaq 8(%rsp), %rdi
+ /* Put us onto the SBM exception stack. */
+ jmp sync_regs
#endif
.Lerror_swapgs: