patches/kernel/0225-x86-pti-Switch-to-kernel-CR3-at-early-in-entry_SYSCA.patch

   1 From ee46485b45de9c2008e3ef5f847041fc18743052 Mon Sep 17 00:00:00 2001
   2 From: Thomas Gleixner <tglx@linutronix.de>
   3 Date: Wed, 3 Jan 2018 19:52:04 +0100
   4 Subject: [PATCH 225/241] x86/pti: Switch to kernel CR3 at early in
   5  entry_SYSCALL_compat()
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 CVE-2017-5754
  11
  12 The preparation for PTI which added CR3 switching to the entry code
  13 misplaced the CR3 switch in entry_SYSCALL_compat().
  14
  15 With PTI enabled the entry code tries to access a per cpu variable after
  16 switching to kernel GS. This fails because that variable is not mapped to
  17 user space. This results in a double fault and in the worst case a kernel
  18 crash.
  19
  20 Move the switch ahead of the access and clobber RSP which has been saved
  21 already.
  22
  23 Fixes: 8a09317b895f ("x86/mm/pti: Prepare the x86/entry assembly code for entry/exit CR3 switching")
  24 Reported-by: Lars Wendler <wendler.lars@web.de>
  25 Reported-by: Laura Abbott <labbott@redhat.com>
  26 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  27 Cc: Borislav Betkov <bp@alien8.de>
  28 Cc: Andy Lutomirski <luto@kernel.org>,
  29 Cc: Dave Hansen <dave.hansen@linux.intel.com>,
  30 Cc: Peter Zijlstra <peterz@infradead.org>,
  31 Cc: Greg KH <gregkh@linuxfoundation.org>, ,
  32 Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>,
  33 Cc: Juergen Gross <jgross@suse.com>
  34 Cc: stable@vger.kernel.org
  35 Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1801031949200.1957@nanos
  36 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  37 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  38 (cherry picked from commit 2f45cd7a57da0a4d7f3a91a5f577c76b9ed9eb8a)
  39 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  40 ---
  41  arch/x86/entry/entry_64_compat.S | 13 ++++++-------
  42  1 file changed, 6 insertions(+), 7 deletions(-)
  43
  44 diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
  45 index 973527e34887..2b5e7685823c 100644
  46 --- a/arch/x86/entry/entry_64_compat.S
  47 +++ b/arch/x86/entry/entry_64_compat.S
  48 @@ -189,8 +189,13 @@ ENTRY(entry_SYSCALL_compat)
  49         /* Interrupts are off on entry. */
  50         swapgs
  51
  52 -       /* Stash user ESP and switch to the kernel stack. */
  53 +       /* Stash user ESP.*/
  54         movl    %esp, %r8d
  55 +
  56 +       /* Use %rsp as scratch reg. User ESP is stashed in r8 */
  57 +       SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
  58 +
  59 +       /* Switch to the kernel stack */
  60         movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
  61
  62         /* Construct struct pt_regs on stack */
  63 @@ -218,12 +223,6 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
  64         pushq   $0                      /* pt_regs->r14 = 0 */
  65         pushq   $0                      /* pt_regs->r15 = 0 */
  66
  67 -       /*
  68 -        * We just saved %rdi so it is safe to clobber.  It is not
  69 -        * preserved during the C calls inside TRACE_IRQS_OFF anyway.
  70 -        */
  71 -       SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
  72 -
  73         /*
  74          * User mode is traced as though IRQs are on, and SYSENTER
  75          * turned them off.
  76 --
  77 2.14.2
  78