Attachment 313340 Details for Bug 457718 – Upstream patch for this issue

[patch] Upstream patch for this issue

0001--Don-t-leak-NT-bit-into-next-task.patch (text/plain), 2.42 KB, created by Eugene Teo (Security Response) on 2008-08-04 07:49:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-08-04 07:49:45 UTC

Size: 2.42 KB

patch

obsolete

>From 658fdbef66e5e9be79b457edc2cbbb3add840aa9 Mon Sep 17 00:00:00 2001
>From: Andi Kleen <ak@suse.de>
>Date: Tue, 26 Sep 2006 10:52:41 +0200
>Subject: [PATCH] [PATCH] Don't leak NT bit into next task
>
>SYSENTER can cause a NT to be set which might cause crashes on the IRET
>in the next task.
>
>Following similar i386 patch from Linus.
>
>Signed-off-by: Andi Kleen <ak@suse.de>
>---
> arch/x86_64/kernel/entry.S   |    4 ++++
> arch/x86_64/kernel/setup64.c |    4 ++++
> include/asm-x86_64/system.h  |    5 +++--
> 3 files changed, 11 insertions(+), 2 deletions(-)
>
>diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
>index 4cbc652..2802524 100644
>--- a/arch/x86_64/kernel/entry.S
>+++ b/arch/x86_64/kernel/entry.S
>@@ -155,6 +155,10 @@
> /* rdi:	prev */	
> ENTRY(ret_from_fork)
> 	CFI_DEFAULT_STACK
>+	push kernel_eflags(%rip)
>+	CFI_ADJUST_CFA_OFFSET 4
>+	popf				# reset kernel eflags
>+	CFI_ADJUST_CFA_OFFSET -4
> 	call schedule_tail
> 	GET_THREAD_INFO(%rcx)
> 	testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT),threadinfo_flags(%rcx)
>diff --git a/arch/x86_64/kernel/setup64.c b/arch/x86_64/kernel/setup64.c
>index 9332d23..8c4b80f 100644
>--- a/arch/x86_64/kernel/setup64.c
>+++ b/arch/x86_64/kernel/setup64.c
>@@ -180,6 +180,8 @@ void __cpuinit check_efer(void)
>         }       
> }
> 
>+unsigned long kernel_eflags;
>+
> /*
>  * cpu_init() initializes state that is per-CPU. Some data is already
>  * initialized (naturally) in the bootstrap process, such as the GDT
>@@ -281,4 +283,6 @@ void __cpuinit cpu_init (void)
> 	set_debugreg(0UL, 7);
> 
> 	fpu_init(); 
>+
>+	raw_local_save_flags(kernel_eflags);
> }
>diff --git a/include/asm-x86_64/system.h b/include/asm-x86_64/system.h
>index 6bf170b..bd376bc 100644
>--- a/include/asm-x86_64/system.h
>+++ b/include/asm-x86_64/system.h
>@@ -14,12 +14,13 @@
> #define __RESTORE(reg,offset) "movq (14-" #offset ")*8(%%rsp),%%" #reg "\n\t"
> 
> /* frame pointer must be last for get_wchan */
>-#define SAVE_CONTEXT    "pushq %%rbp ; movq %%rsi,%%rbp\n\t"
>-#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp\n\t"
>+#define SAVE_CONTEXT    "pushf ; pushq %%rbp ; movq %%rsi,%%rbp\n\t"
>+#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp ; popf\t"
> 
> #define __EXTRA_CLOBBER  \
> 	,"rcx","rbx","rdx","r8","r9","r10","r11","r12","r13","r14","r15"
> 
>+/* Save restore flags to clear handle leaking NT */
> #define switch_to(prev,next,last) \
> 	asm volatile(SAVE_CONTEXT						    \
> 		     "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */	  \
>-- 
>1.5.5.1
>

Actions: View | Diff

Attachments on bug 457718: 313340