patches/kernel/0102-x86-entry-64-Remove-all-remaining-direct-thread_stru.patch

   1 From 50b7c841936979bee6b14253999518e0cf7b3523 Mon Sep 17 00:00:00 2001
   2 From: Andy Lutomirski <luto@kernel.org>
   3 Date: Thu, 2 Nov 2017 00:59:14 -0700
   4 Subject: [PATCH 102/242] x86/entry/64: Remove all remaining direct
   5  thread_struct::sp0 reads
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 CVE-2017-5754
  11
  12 The only remaining readers in context switch code or vm86(), and
  13 they all just want to update TSS.sp0 to match the current task.
  14 Replace them all with a new helper update_sp0().
  15
  16 Signed-off-by: Andy Lutomirski <luto@kernel.org>
  17 Reviewed-by: Borislav Petkov <bp@suse.de>
  18 Cc: Borislav Petkov <bpetkov@suse.de>
  19 Cc: Brian Gerst <brgerst@gmail.com>
  20 Cc: Dave Hansen <dave.hansen@intel.com>
  21 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  22 Cc: Peter Zijlstra <peterz@infradead.org>
  23 Cc: Thomas Gleixner <tglx@linutronix.de>
  24 Link: http://lkml.kernel.org/r/2d231687f4ff288c9d9e98d7861b7df374246ac3.1509609304.git.luto@kernel.org
  25 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  26 (cherry picked from commit 46f5a10a721ce8dce8cc8fe55279b49e1c6b3288)
  27 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  28 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  29 (cherry picked from commit cc87284caa7d31d9d5a55c418eb5278cab6e2db1)
  30 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  31 ---
  32  arch/x86/include/asm/switch_to.h | 6 ++++++
  33  arch/x86/kernel/process_32.c     | 2 +-
  34  arch/x86/kernel/process_64.c     | 2 +-
  35  arch/x86/kernel/vm86_32.c        | 4 ++--
  36  4 files changed, 10 insertions(+), 4 deletions(-)
  37
  38 diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
  39 index 7ae8caffbada..54e64d909725 100644
  40 --- a/arch/x86/include/asm/switch_to.h
  41 +++ b/arch/x86/include/asm/switch_to.h
  42 @@ -84,4 +84,10 @@ static inline void refresh_sysenter_cs(struct thread_struct *thread)
  43  }
  44  #endif
  45
  46 +/* This is used when switching tasks or entering/exiting vm86 mode. */
  47 +static inline void update_sp0(struct task_struct *task)
  48 +{
  49 +       load_sp0(task->thread.sp0);
  50 +}
  51 +
  52  #endif /* _ASM_X86_SWITCH_TO_H */
  53 diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
  54 index 48a3f240f565..c0d60420466c 100644
  55 --- a/arch/x86/kernel/process_32.c
  56 +++ b/arch/x86/kernel/process_32.c
  57 @@ -287,7 +287,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
  58          * current_thread_info().  Refresh the SYSENTER configuration in
  59          * case prev or next is vm86.
  60          */
  61 -       load_sp0(next->sp0);
  62 +       update_sp0(next_p);
  63         refresh_sysenter_cs(next);
  64         this_cpu_write(cpu_current_top_of_stack,
  65                        (unsigned long)task_stack_page(next_p) +
  66 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
  67 index 37b933628a8b..8a748e17bf6e 100644
  68 --- a/arch/x86/kernel/process_64.c
  69 +++ b/arch/x86/kernel/process_64.c
  70 @@ -466,7 +466,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
  71         this_cpu_write(current_task, next_p);
  72
  73         /* Reload sp0. */
  74 -       load_sp0(next->sp0);
  75 +       update_sp0(next_p);
  76
  77         /*
  78          * Now maybe reload the debug registers and handle I/O bitmaps
  79 diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
  80 index 0f1d92cd20ad..a7b44c75c642 100644
  81 --- a/arch/x86/kernel/vm86_32.c
  82 +++ b/arch/x86/kernel/vm86_32.c
  83 @@ -148,7 +148,7 @@ void save_v86_state(struct kernel_vm86_regs *regs, int retval)
  84         preempt_disable();
  85         tsk->thread.sp0 = vm86->saved_sp0;
  86         tsk->thread.sysenter_cs = __KERNEL_CS;
  87 -       load_sp0(tsk->thread.sp0);
  88 +       update_sp0(tsk);
  89         refresh_sysenter_cs(&tsk->thread);
  90         vm86->saved_sp0 = 0;
  91         preempt_enable();
  92 @@ -373,7 +373,7 @@ static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
  93                 refresh_sysenter_cs(&tsk->thread);
  94         }
  95
  96 -       load_sp0(tsk->thread.sp0);
  97 +       update_sp0(tsk);
  98         preempt_enable();
  99
 100         if (vm86->flags & VM86_SCREEN_BITMAP)
 101 --
 102 2.14.2
 103