145 lines
5 KiB
Diff
145 lines
5 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Andy Lutomirski <luto@kernel.org>
|
|
Date: Thu, 2 Nov 2017 00:59:09 -0700
|
|
Subject: [PATCH] x86/entry/32: Pull the MSR_IA32_SYSENTER_CS update code out
|
|
of native_load_sp0()
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
CVE-2017-5754
|
|
|
|
This causes the MSR_IA32_SYSENTER_CS write to move out of the
|
|
paravirt callback. This shouldn't affect Xen PV: Xen already ignores
|
|
MSR_IA32_SYSENTER_ESP writes. In any event, Xen doesn't support
|
|
vm86() in a useful way.
|
|
|
|
Note to any potential backporters: This patch won't break lguest, as
|
|
lguest didn't have any SYSENTER support at all.
|
|
|
|
Signed-off-by: Andy Lutomirski <luto@kernel.org>
|
|
Cc: Borislav Petkov <bpetkov@suse.de>
|
|
Cc: Brian Gerst <brgerst@gmail.com>
|
|
Cc: Dave Hansen <dave.hansen@intel.com>
|
|
Cc: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Cc: Peter Zijlstra <peterz@infradead.org>
|
|
Cc: Thomas Gleixner <tglx@linutronix.de>
|
|
Link: http://lkml.kernel.org/r/75cf09fe03ae778532d0ca6c65aa58e66bc2f90c.1509609304.git.luto@kernel.org
|
|
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
(cherry picked from commit bd7dc5a6afac719d8ce4092391eef2c7e83c2a75)
|
|
Signed-off-by: Andy Whitcroft <apw@canonical.com>
|
|
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
|
|
(cherry picked from commit 779e32d0da9a547f3b11fbecac8287e458ba67f5)
|
|
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
|
---
|
|
arch/x86/include/asm/processor.h | 7 -------
|
|
arch/x86/include/asm/switch_to.h | 12 ++++++++++++
|
|
arch/x86/kernel/process_32.c | 4 +++-
|
|
arch/x86/kernel/process_64.c | 2 +-
|
|
arch/x86/kernel/vm86_32.c | 6 +++++-
|
|
5 files changed, 21 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
|
|
index 028245e1c42b..ee37fb86900a 100644
|
|
--- a/arch/x86/include/asm/processor.h
|
|
+++ b/arch/x86/include/asm/processor.h
|
|
@@ -513,13 +513,6 @@ static inline void
|
|
native_load_sp0(struct tss_struct *tss, struct thread_struct *thread)
|
|
{
|
|
tss->x86_tss.sp0 = thread->sp0;
|
|
-#ifdef CONFIG_X86_32
|
|
- /* Only happens when SEP is enabled, no need to test "SEP"arately: */
|
|
- if (unlikely(tss->x86_tss.ss1 != thread->sysenter_cs)) {
|
|
- tss->x86_tss.ss1 = thread->sysenter_cs;
|
|
- wrmsr(MSR_IA32_SYSENTER_CS, thread->sysenter_cs, 0);
|
|
- }
|
|
-#endif
|
|
}
|
|
|
|
static inline void native_swapgs(void)
|
|
diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
|
|
index fcc5cd387fd1..7ae8caffbada 100644
|
|
--- a/arch/x86/include/asm/switch_to.h
|
|
+++ b/arch/x86/include/asm/switch_to.h
|
|
@@ -72,4 +72,16 @@ do { \
|
|
((last) = __switch_to_asm((prev), (next))); \
|
|
} while (0)
|
|
|
|
+#ifdef CONFIG_X86_32
|
|
+static inline void refresh_sysenter_cs(struct thread_struct *thread)
|
|
+{
|
|
+ /* Only happens when SEP is enabled, no need to test "SEP"arately: */
|
|
+ if (unlikely(this_cpu_read(cpu_tss.x86_tss.ss1) == thread->sysenter_cs))
|
|
+ return;
|
|
+
|
|
+ this_cpu_write(cpu_tss.x86_tss.ss1, thread->sysenter_cs);
|
|
+ wrmsr(MSR_IA32_SYSENTER_CS, thread->sysenter_cs, 0);
|
|
+}
|
|
+#endif
|
|
+
|
|
#endif /* _ASM_X86_SWITCH_TO_H */
|
|
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
|
|
index 22802162eeb9..2e42b66b8ca4 100644
|
|
--- a/arch/x86/kernel/process_32.c
|
|
+++ b/arch/x86/kernel/process_32.c
|
|
@@ -284,9 +284,11 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|
|
|
/*
|
|
* Reload esp0 and cpu_current_top_of_stack. This changes
|
|
- * current_thread_info().
|
|
+ * current_thread_info(). Refresh the SYSENTER configuration in
|
|
+ * case prev or next is vm86.
|
|
*/
|
|
load_sp0(tss, next);
|
|
+ refresh_sysenter_cs(next);
|
|
this_cpu_write(cpu_current_top_of_stack,
|
|
(unsigned long)task_stack_page(next_p) +
|
|
THREAD_SIZE);
|
|
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
|
|
index 1e7701c4cd80..565daaa6f18d 100644
|
|
--- a/arch/x86/kernel/process_64.c
|
|
+++ b/arch/x86/kernel/process_64.c
|
|
@@ -465,7 +465,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|
*/
|
|
this_cpu_write(current_task, next_p);
|
|
|
|
- /* Reload esp0 and ss1. This changes current_thread_info(). */
|
|
+ /* Reload sp0. */
|
|
load_sp0(tss, next);
|
|
|
|
/*
|
|
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
|
|
index 7924a5356c8a..5bc1c3ab6287 100644
|
|
--- a/arch/x86/kernel/vm86_32.c
|
|
+++ b/arch/x86/kernel/vm86_32.c
|
|
@@ -54,6 +54,7 @@
|
|
#include <asm/irq.h>
|
|
#include <asm/traps.h>
|
|
#include <asm/vm86.h>
|
|
+#include <asm/switch_to.h>
|
|
|
|
/*
|
|
* Known problems:
|
|
@@ -149,6 +150,7 @@ void save_v86_state(struct kernel_vm86_regs *regs, int retval)
|
|
tsk->thread.sp0 = vm86->saved_sp0;
|
|
tsk->thread.sysenter_cs = __KERNEL_CS;
|
|
load_sp0(tss, &tsk->thread);
|
|
+ refresh_sysenter_cs(&tsk->thread);
|
|
vm86->saved_sp0 = 0;
|
|
put_cpu();
|
|
|
|
@@ -368,8 +370,10 @@ static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
|
|
/* make room for real-mode segments */
|
|
tsk->thread.sp0 += 16;
|
|
|
|
- if (static_cpu_has(X86_FEATURE_SEP))
|
|
+ if (static_cpu_has(X86_FEATURE_SEP)) {
|
|
tsk->thread.sysenter_cs = 0;
|
|
+ refresh_sysenter_cs(&tsk->thread);
|
|
+ }
|
|
|
|
load_sp0(tss, &tsk->thread);
|
|
put_cpu();
|
|
--
|
|
2.14.2
|
|
|