This is a note to let you know that I've just added the patch titled
x86/entry: Do not allow external 0x80 interrupts
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-entry-do-not-allow-external-0x80-interrupts.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From a3dd5604651a52ba6d435c5346d89bb8cddcbdac Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Date: Mon, 4 Dec 2023 11:31:40 +0300
Subject: x86/entry: Do not allow external 0x80 interrupts
From: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
[ upstream commit 55617fb991df535f953589586468612351575704 ]
The INT 0x80 instruction is used for 32-bit x86 Linux syscalls. The
kernel expects to receive a software interrupt as a result of the INT
0x80 instruction. However, an external interrupt on the same vector
also triggers the same codepath.
An external interrupt on vector 0x80 will currently be interpreted as a
32-bit system call, and assuming that it was a user context.
Panic on external interrupts on the vector.
To distinguish software interrupts from external ones, the kernel checks
the APIC ISR bit relevant to the 0x80 vector. For software interrupts,
this bit will be 0.
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
Signed-off-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
Reviewed-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx> # v6.0+
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/entry/common.c | 37 ++++++++++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -25,6 +25,7 @@
#include <xen/events.h>
#endif
+#include <asm/apic.h>
#include <asm/desc.h>
#include <asm/traps.h>
#include <asm/vdso.h>
@@ -120,6 +121,25 @@ static __always_inline void do_syscall_3
}
#ifdef CONFIG_IA32_EMULATION
+static __always_inline bool int80_is_external(void)
+{
+ const unsigned int offs = (0x80 / 32) * 0x10;
+ const u32 bit = BIT(0x80 % 32);
+
+ /* The local APIC on XENPV guests is fake */
+ if (cpu_feature_enabled(X86_FEATURE_XENPV))
+ return false;
+
+ /*
+ * If vector 0x80 is set in the APIC ISR then this is an external
+ * interrupt. Either from broken hardware or injected by a VMM.
+ *
+ * Note: In guest mode this is only valid for secure guests where
+ * the secure module fully controls the vAPIC exposed to the guest.
+ */
+ return apic_read(APIC_ISR + offs) & bit;
+}
+
/**
* int80_emulation - 32-bit legacy syscall entry
*
@@ -143,12 +163,27 @@ DEFINE_IDTENTRY_RAW(int80_emulation)
{
int nr;
- /* Establish kernel context. */
+ /* Kernel does not use INT $0x80! */
+ if (unlikely(!user_mode(regs))) {
+ irqentry_enter(regs);
+ instrumentation_begin();
+ panic("Unexpected external interrupt 0x80\n");
+ }
+
+ /*
+ * Establish kernel context for instrumentation, including for
+ * int80_is_external() below which calls into the APIC driver.
+ * Identical for soft and external interrupts.
+ */
enter_from_user_mode(regs);
instrumentation_begin();
add_random_kstack_offset();
+ /* Validate that this is a soft interrupt to the extent possible */
+ if (unlikely(int80_is_external()))
+ panic("Unexpected external interrupt 0x80\n");
+
/*
* The low level idtentry code pushed -1 into regs::orig_ax
* and regs::ax contains the syscall number.
Patches currently in stable-queue which might be from tglx@xxxxxxxxxxxxx are
queue-6.6/x86-entry-convert-int-0x80-emulation-to-idtentry.patch
queue-6.6/x86-coco-disable-32-bit-emulation-by-default-on-tdx-and-sev.patch
queue-6.6/x86-introduce-ia32_enabled.patch
queue-6.6/x86-acpi-ignore-invalid-x2apic-entries.patch
queue-6.6/x86-entry-do-not-allow-external-0x80-interrupts.patch
queue-6.6/x86-tdx-allow-32-bit-emulation-by-default.patch
queue-6.6/hrtimers-push-pending-hrtimers-away-from-outgoing-cp.patch
