633c5ed17f
this causes kernel OOPS and upstream is unresponsive about it. see https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1726519
104 lines
3.7 KiB
Diff
104 lines
3.7 KiB
Diff
From 50b7c841936979bee6b14253999518e0cf7b3523 Mon Sep 17 00:00:00 2001
|
|
From: Andy Lutomirski <luto@kernel.org>
|
|
Date: Thu, 2 Nov 2017 00:59:14 -0700
|
|
Subject: [PATCH 102/242] x86/entry/64: Remove all remaining direct
|
|
thread_struct::sp0 reads
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
CVE-2017-5754
|
|
|
|
The only remaining readers in context switch code or vm86(), and
|
|
they all just want to update TSS.sp0 to match the current task.
|
|
Replace them all with a new helper update_sp0().
|
|
|
|
Signed-off-by: Andy Lutomirski <luto@kernel.org>
|
|
Reviewed-by: Borislav Petkov <bp@suse.de>
|
|
Cc: Borislav Petkov <bpetkov@suse.de>
|
|
Cc: Brian Gerst <brgerst@gmail.com>
|
|
Cc: Dave Hansen <dave.hansen@intel.com>
|
|
Cc: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Cc: Peter Zijlstra <peterz@infradead.org>
|
|
Cc: Thomas Gleixner <tglx@linutronix.de>
|
|
Link: http://lkml.kernel.org/r/2d231687f4ff288c9d9e98d7861b7df374246ac3.1509609304.git.luto@kernel.org
|
|
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
|
(cherry picked from commit 46f5a10a721ce8dce8cc8fe55279b49e1c6b3288)
|
|
Signed-off-by: Andy Whitcroft <apw@canonical.com>
|
|
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
|
|
(cherry picked from commit cc87284caa7d31d9d5a55c418eb5278cab6e2db1)
|
|
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
|
---
|
|
arch/x86/include/asm/switch_to.h | 6 ++++++
|
|
arch/x86/kernel/process_32.c | 2 +-
|
|
arch/x86/kernel/process_64.c | 2 +-
|
|
arch/x86/kernel/vm86_32.c | 4 ++--
|
|
4 files changed, 10 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
|
|
index 7ae8caffbada..54e64d909725 100644
|
|
--- a/arch/x86/include/asm/switch_to.h
|
|
+++ b/arch/x86/include/asm/switch_to.h
|
|
@@ -84,4 +84,10 @@ static inline void refresh_sysenter_cs(struct thread_struct *thread)
|
|
}
|
|
#endif
|
|
|
|
+/* This is used when switching tasks or entering/exiting vm86 mode. */
|
|
+static inline void update_sp0(struct task_struct *task)
|
|
+{
|
|
+ load_sp0(task->thread.sp0);
|
|
+}
|
|
+
|
|
#endif /* _ASM_X86_SWITCH_TO_H */
|
|
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
|
|
index 48a3f240f565..c0d60420466c 100644
|
|
--- a/arch/x86/kernel/process_32.c
|
|
+++ b/arch/x86/kernel/process_32.c
|
|
@@ -287,7 +287,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|
* current_thread_info(). Refresh the SYSENTER configuration in
|
|
* case prev or next is vm86.
|
|
*/
|
|
- load_sp0(next->sp0);
|
|
+ update_sp0(next_p);
|
|
refresh_sysenter_cs(next);
|
|
this_cpu_write(cpu_current_top_of_stack,
|
|
(unsigned long)task_stack_page(next_p) +
|
|
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
|
|
index 37b933628a8b..8a748e17bf6e 100644
|
|
--- a/arch/x86/kernel/process_64.c
|
|
+++ b/arch/x86/kernel/process_64.c
|
|
@@ -466,7 +466,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
|
|
this_cpu_write(current_task, next_p);
|
|
|
|
/* Reload sp0. */
|
|
- load_sp0(next->sp0);
|
|
+ update_sp0(next_p);
|
|
|
|
/*
|
|
* Now maybe reload the debug registers and handle I/O bitmaps
|
|
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
|
|
index 0f1d92cd20ad..a7b44c75c642 100644
|
|
--- a/arch/x86/kernel/vm86_32.c
|
|
+++ b/arch/x86/kernel/vm86_32.c
|
|
@@ -148,7 +148,7 @@ void save_v86_state(struct kernel_vm86_regs *regs, int retval)
|
|
preempt_disable();
|
|
tsk->thread.sp0 = vm86->saved_sp0;
|
|
tsk->thread.sysenter_cs = __KERNEL_CS;
|
|
- load_sp0(tsk->thread.sp0);
|
|
+ update_sp0(tsk);
|
|
refresh_sysenter_cs(&tsk->thread);
|
|
vm86->saved_sp0 = 0;
|
|
preempt_enable();
|
|
@@ -373,7 +373,7 @@ static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
|
|
refresh_sysenter_cs(&tsk->thread);
|
|
}
|
|
|
|
- load_sp0(tsk->thread.sp0);
|
|
+ update_sp0(tsk);
|
|
preempt_enable();
|
|
|
|
if (vm86->flags & VM86_SCREEN_BITMAP)
|
|
--
|
|
2.14.2
|
|
|