Revert "x86/syscall: Clear unused extra registers on 32-bit compatible syscall entrance"

CVE-2017-5753 (revert embargoed)
CVE-2017-5715 (revert embargoed)

This reverts commit 725ad2ef81ccceb3e31a7263faae2059d05e2c48.

Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index 0e34002bc8015872c0f091d7e297155ecb71e428..d537818ad2856863c8416f8c108ff82fad29a08b 100644 (file)
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -155,17 +155,6 @@ For 32-bit we have the following conventions - kernel is built with
        popq %rbx
        .endm
 
-       .macro CLEAR_R8_TO_R15
-       xorq %r15, %r15
-       xorq %r14, %r14
-       xorq %r13, %r13
-       xorq %r12, %r12
-       xorq %r11, %r11
-       xorq %r10, %r10
-       xorq %r9, %r9
-       xorq %r8, %r8
-       .endm
-
        .macro CLEAR_EXTRA_REGS
        xorq %r15, %r15
        xorq %r14, %r14

diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 8d7ae9657375a44258cbbb7d8bfd51a785396dc6..1480222bae02a891f9848dd01adb7aa8a97a2122 100644 (file)
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -99,8 +99,6 @@ ENTRY(entry_SYSENTER_compat)
        ENABLE_IBRS
        STUFF_RSB
 
-       CLEAR_R8_TO_R15
-
        /*
         * SYSENTER doesn't filter flags, so we need to clear NT and AC
         * ourselves.  To save a few cycles, we can check whether
@@ -225,12 +223,10 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
        pushq   $0                      /* pt_regs->r11 = 0 */
        pushq   %rbx                    /* pt_regs->rbx */
        pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
-       pushq   %r12                    /* pt_regs->r12 */
-       pushq   %r13                    /* pt_regs->r13 */
-       pushq   %r14                    /* pt_regs->r14 */
-       pushq   %r15                    /* pt_regs->r15 */
-
-       CLEAR_R8_TO_R15
+       pushq   $0                      /* pt_regs->r12 = 0 */
+       pushq   $0                      /* pt_regs->r13 = 0 */
+       pushq   $0                      /* pt_regs->r14 = 0 */
+       pushq   $0                      /* pt_regs->r15 = 0 */
 
        STUFF_RSB
 
@@ -249,10 +245,6 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
        /* Opportunistic SYSRET */
 sysret32_from_system_call:
        TRACE_IRQS_ON                   /* User mode traces as IRQs on. */
-       movq    R15(%rsp), %r15         /* pt_regs->r15 */
-       movq    R14(%rsp), %r14         /* pt_regs->r14 */
-       movq    R13(%rsp), %r13         /* pt_regs->r13 */
-       movq    R12(%rsp), %r12         /* pt_regs->r12 */
        movq    RBX(%rsp), %rbx         /* pt_regs->rbx */
        movq    RBP(%rsp), %rbp         /* pt_regs->rbp */
        movq    EFLAGS(%rsp), %r11      /* pt_regs->flags (in r11) */
@@ -367,8 +359,6 @@ ENTRY(entry_INT80_compat)
        ENABLE_IBRS
        STUFF_RSB
 
-       CLEAR_R8_TO_R15
-
        /*
         * User mode is traced as though IRQs are on, and the interrupt
         * gate turned them off.