238 lines
7.8 KiB
Diff
238 lines
7.8 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Andy Lutomirski <luto@kernel.org>
|
|
Date: Thu, 2 Nov 2017 00:59:10 -0700
|
|
Subject: [PATCH] x86/entry/64: Pass SP0 directly to load_sp0()
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
CVE-2017-5754
|
|
|
|
load_sp0() had an odd signature:
|
|
|
|
void load_sp0(struct tss_struct *tss, struct thread_struct *thread);
|
|
|
|
Simplify it to:
|
|
|
|
void load_sp0(unsigned long sp0);
|
|
|
|
Also simplify a few get_cpu()/put_cpu() sequences to
|
|
preempt_disable()/preempt_enable().
|
|
|
|
Signed-off-by: Andy Lutomirski <luto@kernel.org>
|
|
Reviewed-by: Borislav Petkov <bp@suse.de>
|
|
Cc: Borislav Petkov <bpetkov@suse.de>
|
|
Cc: Brian Gerst <brgerst@gmail.com>
|
|
Cc: Dave Hansen <dave.hansen@intel.com>
|
|
Cc: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Cc: Peter Zijlstra <peterz@infradead.org>
|
|
Cc: Thomas Gleixner <tglx@linutronix.de>
|
|
Link: http://lkml.kernel.org/r/2655d8b42ed940aa384fe18ee1129bbbcf730a08.1509609304.git.luto@kernel.org
|
|
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
(cherry picked from commit da51da189a24bb9b7e2d5a123be096e51a4695a5)
|
|
Signed-off-by: Andy Whitcroft <apw@canonical.com>
|
|
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
|
|
(cherry picked from commit 41f6a89b0be4d052a6af59df5e56102d4e4c79ef)
|
|
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
|
---
|
|
arch/x86/include/asm/paravirt.h | 5 ++---
|
|
arch/x86/include/asm/paravirt_types.h | 2 +-
|
|
arch/x86/include/asm/processor.h | 9 ++++-----
|
|
arch/x86/kernel/cpu/common.c | 4 ++--
|
|
arch/x86/kernel/process_32.c | 2 +-
|
|
arch/x86/kernel/process_64.c | 2 +-
|
|
arch/x86/kernel/vm86_32.c | 14 ++++++--------
|
|
arch/x86/xen/enlighten_pv.c | 7 +++----
|
|
8 files changed, 20 insertions(+), 25 deletions(-)
|
|
|
|
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
|
|
index 12deec722cf0..43d4f90edebc 100644
|
|
--- a/arch/x86/include/asm/paravirt.h
|
|
+++ b/arch/x86/include/asm/paravirt.h
|
|
@@ -15,10 +15,9 @@
|
|
#include <linux/cpumask.h>
|
|
#include <asm/frame.h>
|
|
|
|
-static inline void load_sp0(struct tss_struct *tss,
|
|
- struct thread_struct *thread)
|
|
+static inline void load_sp0(unsigned long sp0)
|
|
{
|
|
- PVOP_VCALL2(pv_cpu_ops.load_sp0, tss, thread);
|
|
+ PVOP_VCALL1(pv_cpu_ops.load_sp0, sp0);
|
|
}
|
|
|
|
/* The paravirtualized CPUID instruction. */
|
|
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
|
|
index 42873edd9f9d..e3953a1e2b57 100644
|
|
--- a/arch/x86/include/asm/paravirt_types.h
|
|
+++ b/arch/x86/include/asm/paravirt_types.h
|
|
@@ -133,7 +133,7 @@ struct pv_cpu_ops {
|
|
void (*alloc_ldt)(struct desc_struct *ldt, unsigned entries);
|
|
void (*free_ldt)(struct desc_struct *ldt, unsigned entries);
|
|
|
|
- void (*load_sp0)(struct tss_struct *tss, struct thread_struct *t);
|
|
+ void (*load_sp0)(unsigned long sp0);
|
|
|
|
void (*set_iopl_mask)(unsigned mask);
|
|
|
|
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
|
|
index ee37fb86900a..85ddfc1a9bb5 100644
|
|
--- a/arch/x86/include/asm/processor.h
|
|
+++ b/arch/x86/include/asm/processor.h
|
|
@@ -510,9 +510,9 @@ static inline void native_set_iopl_mask(unsigned mask)
|
|
}
|
|
|
|
static inline void
|
|
-native_load_sp0(struct tss_struct *tss, struct thread_struct *thread)
|
|
+native_load_sp0(unsigned long sp0)
|
|
{
|
|
- tss->x86_tss.sp0 = thread->sp0;
|
|
+ this_cpu_write(cpu_tss.x86_tss.sp0, sp0);
|
|
}
|
|
|
|
static inline void native_swapgs(void)
|
|
@@ -537,10 +537,9 @@ static inline unsigned long current_top_of_stack(void)
|
|
#else
|
|
#define __cpuid native_cpuid
|
|
|
|
-static inline void load_sp0(struct tss_struct *tss,
|
|
- struct thread_struct *thread)
|
|
+static inline void load_sp0(unsigned long sp0)
|
|
{
|
|
- native_load_sp0(tss, thread);
|
|
+ native_load_sp0(sp0);
|
|
}
|
|
|
|
#define set_iopl_mask native_set_iopl_mask
|
|
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
|
|
index ef7b1ba56363..6562acbfc4e0 100644
|
|
--- a/arch/x86/kernel/cpu/common.c
|
|
+++ b/arch/x86/kernel/cpu/common.c
|
|
@@ -1570,7 +1570,7 @@ void cpu_init(void)
|
|
BUG_ON(me->mm);
|
|
enter_lazy_tlb(&init_mm, me);
|
|
|
|
- load_sp0(t, ¤t->thread);
|
|
+ load_sp0(current->thread.sp0);
|
|
set_tss_desc(cpu, t);
|
|
load_TR_desc();
|
|
load_mm_ldt(&init_mm);
|
|
@@ -1624,7 +1624,7 @@ void cpu_init(void)
|
|
BUG_ON(curr->mm);
|
|
enter_lazy_tlb(&init_mm, curr);
|
|
|
|
- load_sp0(t, thread);
|
|
+ load_sp0(thread->sp0);
|
|
set_tss_desc(cpu, t);
|
|
load_TR_desc();
|
|
load_mm_ldt(&init_mm);
|
|
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
|
|
index 2e42b66b8ca4..48a3f240f565 100644
|
|
--- a/arch/x86/kernel/process_32.c
|
|
+++ b/arch/x86/kernel/process_32.c
|
|
@@ -287,7 +287,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|
* current_thread_info(). Refresh the SYSENTER configuration in
|
|
* case prev or next is vm86.
|
|
*/
|
|
- load_sp0(tss, next);
|
|
+ load_sp0(next->sp0);
|
|
refresh_sysenter_cs(next);
|
|
this_cpu_write(cpu_current_top_of_stack,
|
|
(unsigned long)task_stack_page(next_p) +
|
|
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
|
|
index 565daaa6f18d..37b933628a8b 100644
|
|
--- a/arch/x86/kernel/process_64.c
|
|
+++ b/arch/x86/kernel/process_64.c
|
|
@@ -466,7 +466,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|
this_cpu_write(current_task, next_p);
|
|
|
|
/* Reload sp0. */
|
|
- load_sp0(tss, next);
|
|
+ load_sp0(next->sp0);
|
|
|
|
/*
|
|
* Now maybe reload the debug registers and handle I/O bitmaps
|
|
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
|
|
index 5bc1c3ab6287..0f1d92cd20ad 100644
|
|
--- a/arch/x86/kernel/vm86_32.c
|
|
+++ b/arch/x86/kernel/vm86_32.c
|
|
@@ -94,7 +94,6 @@
|
|
|
|
void save_v86_state(struct kernel_vm86_regs *regs, int retval)
|
|
{
|
|
- struct tss_struct *tss;
|
|
struct task_struct *tsk = current;
|
|
struct vm86plus_struct __user *user;
|
|
struct vm86 *vm86 = current->thread.vm86;
|
|
@@ -146,13 +145,13 @@ void save_v86_state(struct kernel_vm86_regs *regs, int retval)
|
|
do_exit(SIGSEGV);
|
|
}
|
|
|
|
- tss = &per_cpu(cpu_tss, get_cpu());
|
|
+ preempt_disable();
|
|
tsk->thread.sp0 = vm86->saved_sp0;
|
|
tsk->thread.sysenter_cs = __KERNEL_CS;
|
|
- load_sp0(tss, &tsk->thread);
|
|
+ load_sp0(tsk->thread.sp0);
|
|
refresh_sysenter_cs(&tsk->thread);
|
|
vm86->saved_sp0 = 0;
|
|
- put_cpu();
|
|
+ preempt_enable();
|
|
|
|
memcpy(®s->pt, &vm86->regs32, sizeof(struct pt_regs));
|
|
|
|
@@ -238,7 +237,6 @@ SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
|
|
|
|
static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
|
|
{
|
|
- struct tss_struct *tss;
|
|
struct task_struct *tsk = current;
|
|
struct vm86 *vm86 = tsk->thread.vm86;
|
|
struct kernel_vm86_regs vm86regs;
|
|
@@ -366,8 +364,8 @@ static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
|
|
vm86->saved_sp0 = tsk->thread.sp0;
|
|
lazy_save_gs(vm86->regs32.gs);
|
|
|
|
- tss = &per_cpu(cpu_tss, get_cpu());
|
|
/* make room for real-mode segments */
|
|
+ preempt_disable();
|
|
tsk->thread.sp0 += 16;
|
|
|
|
if (static_cpu_has(X86_FEATURE_SEP)) {
|
|
@@ -375,8 +373,8 @@ static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
|
|
refresh_sysenter_cs(&tsk->thread);
|
|
}
|
|
|
|
- load_sp0(tss, &tsk->thread);
|
|
- put_cpu();
|
|
+ load_sp0(tsk->thread.sp0);
|
|
+ preempt_enable();
|
|
|
|
if (vm86->flags & VM86_SCREEN_BITMAP)
|
|
mark_screen_rdonly(tsk->mm);
|
|
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
|
|
index 8da4eff19c2a..e7b213047724 100644
|
|
--- a/arch/x86/xen/enlighten_pv.c
|
|
+++ b/arch/x86/xen/enlighten_pv.c
|
|
@@ -810,15 +810,14 @@ static void __init xen_write_gdt_entry_boot(struct desc_struct *dt, int entry,
|
|
}
|
|
}
|
|
|
|
-static void xen_load_sp0(struct tss_struct *tss,
|
|
- struct thread_struct *thread)
|
|
+static void xen_load_sp0(unsigned long sp0)
|
|
{
|
|
struct multicall_space mcs;
|
|
|
|
mcs = xen_mc_entry(0);
|
|
- MULTI_stack_switch(mcs.mc, __KERNEL_DS, thread->sp0);
|
|
+ MULTI_stack_switch(mcs.mc, __KERNEL_DS, sp0);
|
|
xen_mc_issue(PARAVIRT_LAZY_CPU);
|
|
- tss->x86_tss.sp0 = thread->sp0;
|
|
+ this_cpu_write(cpu_tss.x86_tss.sp0, sp0);
|
|
}
|
|
|
|
void xen_set_iopl_mask(unsigned mask)
|
|
--
|
|
2.14.2
|
|
|