patches/kernel/0289-x86-syscall-Clear-unused-extra-registers-on-32-bit-c.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Tim Chen <tim.c.chen@linux.intel.com>
   3 Date: Fri, 15 Sep 2017 19:41:24 -0700
   4 Subject: [PATCH] x86/syscall: Clear unused extra registers on 32-bit
   5  compatible syscall entrance
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 CVE-2017-5753
  11 CVE-2017-5715
  12
  13 To prevent the unused registers %r8-%r15, from being used speculatively,
  14 we clear them upon syscall entrance for code hygiene in 32 bit compatible
  15 mode.
  16
  17 Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
  18 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  19 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  20 (cherry picked from commit 725ad2ef81ccceb3e31a7263faae2059d05e2c48)
  21 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  22 ---
  23  arch/x86/entry/calling.h         | 11 +++++++++++
  24  arch/x86/entry/entry_64_compat.S | 18 ++++++++++++++----
  25  2 files changed, 25 insertions(+), 4 deletions(-)
  26
  27 diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
  28 index d537818ad285..0e34002bc801 100644
  29 --- a/arch/x86/entry/calling.h
  30 +++ b/arch/x86/entry/calling.h
  31 @@ -155,6 +155,17 @@ For 32-bit we have the following conventions - kernel is built with
  32         popq %rbx
  33         .endm
  34
  35 +       .macro CLEAR_R8_TO_R15
  36 +       xorq %r15, %r15
  37 +       xorq %r14, %r14
  38 +       xorq %r13, %r13
  39 +       xorq %r12, %r12
  40 +       xorq %r11, %r11
  41 +       xorq %r10, %r10
  42 +       xorq %r9, %r9
  43 +       xorq %r8, %r8
  44 +       .endm
  45 +
  46         .macro CLEAR_EXTRA_REGS
  47         xorq %r15, %r15
  48         xorq %r14, %r14
  49 diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
  50 index 1480222bae02..8d7ae9657375 100644
  51 --- a/arch/x86/entry/entry_64_compat.S
  52 +++ b/arch/x86/entry/entry_64_compat.S
  53 @@ -99,6 +99,8 @@ ENTRY(entry_SYSENTER_compat)
  54         ENABLE_IBRS
  55         STUFF_RSB
  56
  57 +       CLEAR_R8_TO_R15
  58 +
  59         /*
  60          * SYSENTER doesn't filter flags, so we need to clear NT and AC
  61          * ourselves.  To save a few cycles, we can check whether
  62 @@ -223,10 +225,12 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
  63         pushq   $0                      /* pt_regs->r11 = 0 */
  64         pushq   %rbx                    /* pt_regs->rbx */
  65         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
  66 -       pushq   $0                      /* pt_regs->r12 = 0 */
  67 -       pushq   $0                      /* pt_regs->r13 = 0 */
  68 -       pushq   $0                      /* pt_regs->r14 = 0 */
  69 -       pushq   $0                      /* pt_regs->r15 = 0 */
  70 +       pushq   %r12                    /* pt_regs->r12 */
  71 +       pushq   %r13                    /* pt_regs->r13 */
  72 +       pushq   %r14                    /* pt_regs->r14 */
  73 +       pushq   %r15                    /* pt_regs->r15 */
  74 +
  75 +       CLEAR_R8_TO_R15
  76
  77         STUFF_RSB
  78
  79 @@ -245,6 +249,10 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
  80         /* Opportunistic SYSRET */
  81  sysret32_from_system_call:
  82         TRACE_IRQS_ON                   /* User mode traces as IRQs on. */
  83 +       movq    R15(%rsp), %r15         /* pt_regs->r15 */
  84 +       movq    R14(%rsp), %r14         /* pt_regs->r14 */
  85 +       movq    R13(%rsp), %r13         /* pt_regs->r13 */
  86 +       movq    R12(%rsp), %r12         /* pt_regs->r12 */
  87         movq    RBX(%rsp), %rbx         /* pt_regs->rbx */
  88         movq    RBP(%rsp), %rbp         /* pt_regs->rbp */
  89         movq    EFLAGS(%rsp), %r11      /* pt_regs->flags (in r11) */
  90 @@ -359,6 +367,8 @@ ENTRY(entry_INT80_compat)
  91         ENABLE_IBRS
  92         STUFF_RSB
  93
  94 +       CLEAR_R8_TO_R15
  95 +
  96         /*
  97          * User mode is traced as though IRQs are on, and the interrupt
  98          * gate turned them off.
  99 --
 100 2.14.2
 101