Attachment 75839 Details for Bug 156580

[patch] 2.6 patch 1

force-iret (text/plain), 1.92 KB, created by Andreas Kleen on 2006-03-30 19:28:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Kleen

Created: 2006-03-30 19:28:53 UTC

Size: 1.92 KB

patch

obsolete

>When user can have changed stack frame always force IRET
>
>That is because both AMD and Intel CPUs have trouble with uncanonical
>returned addresses in SYSRET.
>
>On Intel: 
>- The exception is reported in the SYSRET, not the next instruction like
>AMD would. This leads to the kernel exception handler running on the user stack
>with the wrong GS.
>
>On AMD:
>- Some revisions of K8 lock up when SYSRET jumps to the boundary between
>canonical and un canonical
>
>This version of the patch has the teething problems that plagued an earlier
>version fixed.
>
>This is CVE-2006-0744
>
>Contributors to the analysis are Ernie Petrides and Petr Baudis
>
>Signed-off-by: Andi Kleen <ak@suse.de>
>
>---
> arch/x86_64/kernel/entry.S |   12 ++++++++++--
> 1 files changed, 10 insertions(+), 2 deletions(-)
>
>Index: linux/arch/x86_64/kernel/entry.S
>===================================================================
>--- linux.orig/arch/x86_64/kernel/entry.S
>+++ linux/arch/x86_64/kernel/entry.S
>@@ -180,6 +180,10 @@ rff_trace:
>  *
>  * XXX	if we had a free scratch register we could save the RSP into the stack frame
>  *      and report it properly in ps. Unfortunately we haven't.
>+ *
>+ * When user can change the frames always force IRET. That is because
>+ * it deals with uncanonical addresses better. SYSRET has trouble
>+ * with them due to bugs in both AMD and Intel CPUs.
>  */ 			 		
> 
> ENTRY(system_call)
>@@ -254,7 +258,10 @@ sysret_signal:
> 	xorl %esi,%esi # oldset -> arg2
> 	call ptregscall_common
> 1:	movl $_TIF_NEED_RESCHED,%edi
>-	jmp sysret_check
>+	/* Use IRET because user could have changed frame. This
>+	   works because ptregscall_common has called FIXUP_TOP_OF_STACK. */
>+	cli
>+	jmp int_with_check
> 	
> badsys:
> 	movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
>@@ -280,7 +287,8 @@ tracesys:			 
> 	call syscall_trace_leave
> 	RESTORE_TOP_OF_STACK %rbx
> 	RESTORE_REST
>-	jmp ret_from_sys_call
>+	/* Use IRET because user could have changed frame */
>+	jmp int_ret_from_sys_call
> 	CFI_ENDPROC
> 		
> /*

Actions: View | Diff

Attachments on bug 156580: 72752 | 72753 | 72754 | 75839 | 75840