3.16.58-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski luto@kernel.org
commit b3681dd548d06deb2e1573890829dff4b15abf46 upstream.
error_entry and error_exit communicate the user vs. kernel status of the frame using %ebx. This is unnecessary -- the information is in regs->cs. Just use regs->cs.
This makes error_entry simpler and makes error_exit more robust.
It also fixes a nasty bug. Before all the Spectre nonsense, the xen_failsafe_callback entry point returned like this:
ALLOC_PT_GPREGS_ON_STACK SAVE_C_REGS SAVE_EXTRA_REGS ENCODE_FRAME_POINTER jmp error_exit
And it did not go through error_entry. This was bogus: RBX contained garbage, and error_exit expected a flag in RBX.
Fortunately, it generally contained *nonzero* garbage, so the correct code path was used. As part of the Spectre fixes, code was added to clear RBX to mitigate certain speculation attacks. Now, depending on kernel configuration, RBX got zeroed and, when running some Wine workloads, the kernel crashes. This was introduced by:
commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
With this patch applied, RBX is no longer needed as a flag, and the problem goes away.
I suspect that malicious userspace could use this bug to crash the kernel even without the offending patch applied, though.
[ Historical note: I wrote this patch as a cleanup before I was aware of the bug it fixed. ]
[ Note to stable maintainers: this should probably get applied to all kernels. If you're nervous about that, a more conservative fix to add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should also fix the problem. ]
Reported-and-tested-by: M. Vefa Bicakci m.v.b@runbox.com Signed-off-by: Andy Lutomirski luto@kernel.org Cc: Boris Ostrovsky boris.ostrovsky@oracle.com Cc: Borislav Petkov bp@alien8.de Cc: Brian Gerst brgerst@gmail.com Cc: Dave Hansen dave.hansen@linux.intel.com Cc: Denys Vlasenko dvlasenk@redhat.com Cc: Dominik Brodowski linux@dominikbrodowski.net Cc: Greg KH gregkh@linuxfoundation.org Cc: H. Peter Anvin hpa@zytor.com Cc: Josh Poimboeuf jpoimboe@redhat.com Cc: Juergen Gross jgross@suse.com Cc: Linus Torvalds torvalds@linux-foundation.org Cc: Peter Zijlstra peterz@infradead.org Cc: Thomas Gleixner tglx@linutronix.de Cc: xen-devel@lists.xenproject.org Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface") Link: http://lkml.kernel.org/r/b5010a090d3586b2d6e06c7ad3ec5542d1241c45.1532282627... Signed-off-by: Ingo Molnar mingo@kernel.org [bwh: Backported to 3.16: - error_exit moved EBX to EAX before testing it, so delete both instructions - error_exit does RESTORE_REST earlier, so adjust the offset to saved CS accordingly - Drop inapplicable comment changes - Adjust filename, context] Signed-off-by: Ben Hutchings ben@decadent.org.uk --- --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1135,7 +1135,7 @@ ENTRY(\sym) .if \paranoid jmp paranoid_exit /* %ebx: no swapgs flag */ .else - jmp error_exit /* %ebx: no swapgs flag */ + jmp error_exit .endif
CFI_ENDPROC @@ -1411,7 +1411,6 @@ END(paranoid_exit)
/* * Exception entry point. This expects an error code/orig_rax on the stack. - * returns in "no swapgs flag" in %ebx. */ ENTRY(error_entry) XCPT_FRAME @@ -1440,7 +1439,6 @@ ENTRY(error_entry) * the kernel CR3 here. */ SWITCH_KERNEL_CR3 - xorl %ebx,%ebx testl $3,CS+8(%rsp) je error_kernelspace error_swapgs: @@ -1456,7 +1454,6 @@ error_sti: * for these here too. */ error_kernelspace: - incl %ebx leaq native_irq_return_iret(%rip),%rcx cmpq %rcx,RIP+8(%rsp) je error_bad_iret @@ -1477,22 +1474,18 @@ error_bad_iret: mov %rsp,%rdi call fixup_bad_iret mov %rax,%rsp - decl %ebx /* Return to usergs */ jmp error_sti CFI_ENDPROC END(error_entry)
- -/* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */ ENTRY(error_exit) DEFAULT_FRAME - movl %ebx,%eax RESTORE_REST DISABLE_INTERRUPTS(CLBR_NONE) TRACE_IRQS_OFF GET_THREAD_INFO(%rcx) - testl %eax,%eax - jne retint_kernel + testb $3, CS-ARGOFFSET(%rsp) + jz retint_kernel LOCKDEP_SYS_EXIT_IRQ movl TI_flags(%rcx),%edx movl $_TIF_WORK_MASK,%edi