]>
Commit | Line | Data |
---|---|---|
321d628a FG |
1 | From 271bc7d0577bef9f344187eb45ba8682eed242f9 Mon Sep 17 00:00:00 2001 |
2 | From: Andy Lutomirski <luto@kernel.org> | |
3 | Date: Thu, 2 Nov 2017 00:59:00 -0700 | |
633c5ed1 | 4 | Subject: [PATCH 088/242] x86/entry/64: Move SWAPGS into the common |
321d628a FG |
5 | IRET-to-usermode path |
6 | MIME-Version: 1.0 | |
7 | Content-Type: text/plain; charset=UTF-8 | |
8 | Content-Transfer-Encoding: 8bit | |
9 | ||
10 | CVE-2017-5754 | |
11 | ||
12 | All of the code paths that ended up doing IRET to usermode did | |
13 | SWAPGS immediately beforehand. Move the SWAPGS into the common | |
14 | code. | |
15 | ||
16 | Signed-off-by: Andy Lutomirski <luto@kernel.org> | |
17 | Cc: Borislav Petkov <bpetkov@suse.de> | |
18 | Cc: Brian Gerst <brgerst@gmail.com> | |
19 | Cc: Dave Hansen <dave.hansen@intel.com> | |
20 | Cc: Linus Torvalds <torvalds@linux-foundation.org> | |
21 | Cc: Peter Zijlstra <peterz@infradead.org> | |
22 | Cc: Thomas Gleixner <tglx@linutronix.de> | |
23 | Link: http://lkml.kernel.org/r/27fd6f45b7cd640de38fb9066fd0349bcd11f8e1.1509609304.git.luto@kernel.org | |
24 | Signed-off-by: Ingo Molnar <mingo@kernel.org> | |
25 | (cherry picked from commit 8a055d7f411d41755ce30db5bb65b154777c4b78) | |
26 | Signed-off-by: Andy Whitcroft <apw@canonical.com> | |
27 | Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
28 | (cherry picked from commit 62a85594f9be3baeb2495089f1c2980bc497d03b) | |
29 | Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> | |
30 | --- | |
31 | arch/x86/entry/entry_64.S | 32 ++++++++++++++------------------ | |
32 | arch/x86/entry/entry_64_compat.S | 3 +-- | |
33 | 2 files changed, 15 insertions(+), 20 deletions(-) | |
34 | ||
35 | diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S | |
36 | index e546441fbec3..7c8258e3ad2d 100644 | |
37 | --- a/arch/x86/entry/entry_64.S | |
38 | +++ b/arch/x86/entry/entry_64.S | |
39 | @@ -249,12 +249,14 @@ return_from_SYSCALL_64: | |
40 | ||
41 | /* | |
42 | * Try to use SYSRET instead of IRET if we're returning to | |
43 | - * a completely clean 64-bit userspace context. | |
44 | + * a completely clean 64-bit userspace context. If we're not, | |
45 | + * go to the slow exit path. | |
46 | */ | |
47 | movq RCX(%rsp), %rcx | |
48 | movq RIP(%rsp), %r11 | |
49 | - cmpq %rcx, %r11 /* RCX == RIP */ | |
50 | - jne opportunistic_sysret_failed | |
51 | + | |
52 | + cmpq %rcx, %r11 /* SYSRET requires RCX == RIP */ | |
53 | + jne swapgs_restore_regs_and_return_to_usermode | |
54 | ||
55 | /* | |
56 | * On Intel CPUs, SYSRET with non-canonical RCX/RIP will #GP | |
57 | @@ -272,14 +274,14 @@ return_from_SYSCALL_64: | |
58 | ||
59 | /* If this changed %rcx, it was not canonical */ | |
60 | cmpq %rcx, %r11 | |
61 | - jne opportunistic_sysret_failed | |
62 | + jne swapgs_restore_regs_and_return_to_usermode | |
63 | ||
64 | cmpq $__USER_CS, CS(%rsp) /* CS must match SYSRET */ | |
65 | - jne opportunistic_sysret_failed | |
66 | + jne swapgs_restore_regs_and_return_to_usermode | |
67 | ||
68 | movq R11(%rsp), %r11 | |
69 | cmpq %r11, EFLAGS(%rsp) /* R11 == RFLAGS */ | |
70 | - jne opportunistic_sysret_failed | |
71 | + jne swapgs_restore_regs_and_return_to_usermode | |
72 | ||
73 | /* | |
74 | * SYSCALL clears RF when it saves RFLAGS in R11 and SYSRET cannot | |
75 | @@ -300,12 +302,12 @@ return_from_SYSCALL_64: | |
76 | * would never get past 'stuck_here'. | |
77 | */ | |
78 | testq $(X86_EFLAGS_RF|X86_EFLAGS_TF), %r11 | |
79 | - jnz opportunistic_sysret_failed | |
80 | + jnz swapgs_restore_regs_and_return_to_usermode | |
81 | ||
82 | /* nothing to check for RSP */ | |
83 | ||
84 | cmpq $__USER_DS, SS(%rsp) /* SS must match SYSRET */ | |
85 | - jne opportunistic_sysret_failed | |
86 | + jne swapgs_restore_regs_and_return_to_usermode | |
87 | ||
88 | /* | |
89 | * We win! This label is here just for ease of understanding | |
90 | @@ -318,10 +320,6 @@ syscall_return_via_sysret: | |
91 | movq RSP(%rsp), %rsp | |
92 | UNWIND_HINT_EMPTY | |
93 | USERGS_SYSRET64 | |
94 | - | |
95 | -opportunistic_sysret_failed: | |
96 | - SWAPGS | |
97 | - jmp restore_regs_and_return_to_usermode | |
98 | END(entry_SYSCALL_64) | |
99 | ||
100 | ENTRY(stub_ptregs_64) | |
101 | @@ -422,8 +420,7 @@ ENTRY(ret_from_fork) | |
102 | movq %rsp, %rdi | |
103 | call syscall_return_slowpath /* returns with IRQs disabled */ | |
104 | TRACE_IRQS_ON /* user mode is traced as IRQS on */ | |
105 | - SWAPGS | |
106 | - jmp restore_regs_and_return_to_usermode | |
107 | + jmp swapgs_restore_regs_and_return_to_usermode | |
108 | ||
109 | 1: | |
110 | /* kernel thread */ | |
111 | @@ -611,9 +608,8 @@ GLOBAL(retint_user) | |
112 | mov %rsp,%rdi | |
113 | call prepare_exit_to_usermode | |
114 | TRACE_IRQS_IRETQ | |
115 | - SWAPGS | |
116 | ||
117 | -GLOBAL(restore_regs_and_return_to_usermode) | |
118 | +GLOBAL(swapgs_restore_regs_and_return_to_usermode) | |
119 | #ifdef CONFIG_DEBUG_ENTRY | |
120 | /* Assert that pt_regs indicates user mode. */ | |
121 | testl $3, CS(%rsp) | |
122 | @@ -621,6 +617,7 @@ GLOBAL(restore_regs_and_return_to_usermode) | |
123 | ud2 | |
124 | 1: | |
125 | #endif | |
126 | + SWAPGS | |
127 | RESTORE_EXTRA_REGS | |
128 | RESTORE_C_REGS | |
129 | REMOVE_PT_GPREGS_FROM_STACK 8 | |
130 | @@ -1355,8 +1352,7 @@ ENTRY(nmi) | |
131 | * Return back to user mode. We must *not* do the normal exit | |
132 | * work, because we don't want to enable interrupts. | |
133 | */ | |
134 | - SWAPGS | |
135 | - jmp restore_regs_and_return_to_usermode | |
136 | + jmp swapgs_restore_regs_and_return_to_usermode | |
137 | ||
138 | .Lnmi_from_kernel: | |
139 | /* | |
140 | diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S | |
141 | index 2b3a88feaa2b..be745b7a3e3e 100644 | |
142 | --- a/arch/x86/entry/entry_64_compat.S | |
143 | +++ b/arch/x86/entry/entry_64_compat.S | |
144 | @@ -336,8 +336,7 @@ ENTRY(entry_INT80_compat) | |
145 | ||
146 | /* Go back to user mode. */ | |
147 | TRACE_IRQS_ON | |
148 | - SWAPGS | |
149 | - jmp restore_regs_and_return_to_usermode | |
150 | + jmp swapgs_restore_regs_and_return_to_usermode | |
151 | END(entry_INT80_compat) | |
152 | ||
153 | ALIGN | |
154 | -- | |
155 | 2.14.2 | |
156 |