Re: Patch "x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C" has been added to the 3.17-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This and "Rework bad_iret" fix bugs that are extremely difficult to
trigger, so it may pay to wait a week or two before backporting them.

--Andy

On Wed, Dec 3, 2014 at 2:22 PM,  <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> This is a note to let you know that I've just added the patch titled
>
>     x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C
>
> to the 3.17-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>
> The filename of the patch is:
>      x86_64-traps-fix-the-espfix64-df-fixup-and-rewrite-it-in-c.patch
> and it can be found in the queue-3.17 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@xxxxxxxxxxxxxxx> know about it.
>
>
> From af726f21ed8af2cdaa4e93098dc211521218ae65 Mon Sep 17 00:00:00 2001
> From: Andy Lutomirski <luto@xxxxxxxxxxxxxx>
> Date: Sat, 22 Nov 2014 18:00:31 -0800
> Subject: x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C
>
> From: Andy Lutomirski <luto@xxxxxxxxxxxxxx>
>
> commit af726f21ed8af2cdaa4e93098dc211521218ae65 upstream.
>
> There's nothing special enough about the espfix64 double fault fixup to
> justify writing it in assembly.  Move it to C.
>
> This also fixes a bug: if the double fault came from an IST stack, the
> old asm code would return to a partially uninitialized stack frame.
>
> Fixes: 3891a04aafd668686239349ea58f3314ea2af86b
> Signed-off-by: Andy Lutomirski <luto@xxxxxxxxxxxxxx>
> Reviewed-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
>
> ---
>  arch/x86/kernel/entry_64.S |   34 ++--------------------------------
>  arch/x86/kernel/traps.c    |   24 ++++++++++++++++++++++++
>  2 files changed, 26 insertions(+), 32 deletions(-)
>
> --- a/arch/x86/kernel/entry_64.S
> +++ b/arch/x86/kernel/entry_64.S
> @@ -841,6 +841,7 @@ ENTRY(native_iret)
>         jnz native_irq_return_ldt
>  #endif
>
> +.global native_irq_return_iret
>  native_irq_return_iret:
>         iretq
>         _ASM_EXTABLE(native_irq_return_iret, bad_iret)
> @@ -935,37 +936,6 @@ ENTRY(retint_kernel)
>         CFI_ENDPROC
>  END(common_interrupt)
>
> -       /*
> -        * If IRET takes a fault on the espfix stack, then we
> -        * end up promoting it to a doublefault.  In that case,
> -        * modify the stack to make it look like we just entered
> -        * the #GP handler from user space, similar to bad_iret.
> -        */
> -#ifdef CONFIG_X86_ESPFIX64
> -       ALIGN
> -__do_double_fault:
> -       XCPT_FRAME 1 RDI+8
> -       movq RSP(%rdi),%rax             /* Trap on the espfix stack? */
> -       sarq $PGDIR_SHIFT,%rax
> -       cmpl $ESPFIX_PGD_ENTRY,%eax
> -       jne do_double_fault             /* No, just deliver the fault */
> -       cmpl $__KERNEL_CS,CS(%rdi)
> -       jne do_double_fault
> -       movq RIP(%rdi),%rax
> -       cmpq $native_irq_return_iret,%rax
> -       jne do_double_fault             /* This shouldn't happen... */
> -       movq PER_CPU_VAR(kernel_stack),%rax
> -       subq $(6*8-KERNEL_STACK_OFFSET),%rax    /* Reset to original stack */
> -       movq %rax,RSP(%rdi)
> -       movq $0,(%rax)                  /* Missing (lost) #GP error code */
> -       movq $general_protection,RIP(%rdi)
> -       retq
> -       CFI_ENDPROC
> -END(__do_double_fault)
> -#else
> -# define __do_double_fault do_double_fault
> -#endif
> -
>  /*
>   * APIC interrupts.
>   */
> @@ -1137,7 +1107,7 @@ idtentry overflow do_overflow has_error_
>  idtentry bounds do_bounds has_error_code=0
>  idtentry invalid_op do_invalid_op has_error_code=0
>  idtentry device_not_available do_device_not_available has_error_code=0
> -idtentry double_fault __do_double_fault has_error_code=1 paranoid=1
> +idtentry double_fault do_double_fault has_error_code=1 paranoid=1
>  idtentry coprocessor_segment_overrun do_coprocessor_segment_overrun has_error_code=0
>  idtentry invalid_TSS do_invalid_TSS has_error_code=1
>  idtentry segment_not_present do_segment_not_present has_error_code=1
> --- a/arch/x86/kernel/traps.c
> +++ b/arch/x86/kernel/traps.c
> @@ -259,6 +259,30 @@ dotraplinkage void do_double_fault(struc
>         static const char str[] = "double fault";
>         struct task_struct *tsk = current;
>
> +#ifdef CONFIG_X86_ESPFIX64
> +       extern unsigned char native_irq_return_iret[];
> +
> +       /*
> +        * If IRET takes a non-IST fault on the espfix64 stack, then we
> +        * end up promoting it to a doublefault.  In that case, modify
> +        * the stack to make it look like we just entered the #GP
> +        * handler from user space, similar to bad_iret.
> +        */
> +       if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
> +               regs->cs == __KERNEL_CS &&
> +               regs->ip == (unsigned long)native_irq_return_iret)
> +       {
> +               struct pt_regs *normal_regs = task_pt_regs(current);
> +
> +               /* Fake a #GP(0) from userspace. */
> +               memmove(&normal_regs->ip, (void *)regs->sp, 5*8);
> +               normal_regs->orig_ax = 0;  /* Missing (lost) #GP error code */
> +               regs->ip = (unsigned long)general_protection;
> +               regs->sp = (unsigned long)&normal_regs->orig_ax;
> +               return;
> +       }
> +#endif
> +
>         exception_enter();
>         /* Return not checked because double check cannot be ignored */
>         notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);
>
>
> Patches currently in stable-queue which might be from luto@xxxxxxxxxxxxxx are
>
> queue-3.17/x86_64-traps-stop-using-ist-for-ss.patch
> queue-3.17/x86_64-traps-fix-the-espfix64-df-fixup-and-rewrite-it-in-c.patch
> queue-3.17/x86_64-traps-rework-bad_iret.patch



-- 
Andy Lutomirski
AMA Capital Management, LLC
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]