1 From: http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/9b9454800544
2 # HG changeset 870 patch
3 # User Keir Fraser <keir.fraser@citrix.com>
4 # Date 1242292120 -3600
5 # Node ID 9b945480054430882b60bb5e5f660822a1c07b70
6 # Parent 271d9b9bee40657b1714b2bb62531e989c7b5813
7 Subject: i386: hypervisor_callback adjustments
8 References: bnc#503457 CVE-2009-1758
9 Patch-mainline: obsolete
11 The missing check of the interrupted code's code selector in
12 hypervisor_callback() allowed a user mode application to oops (and
13 perhaps crash) the kernel.
16 - the 'main' critical region does not include the jmp following the
17 disabling of interrupts
18 - the sysexit_[se]crit range checks got broken at some point - the
19 sysexit ciritcal region is always at higher addresses than the
21 one, yielding the check pointless (but consuming execution time);
22 since the supervisor mode kernel isn't actively used afaict, I moved
23 that code into an #ifdef using a hypothetical config option
24 - the use of a numeric label across more than 300 lines of code always
25 seemed pretty fragile to me, so the patch replaces this with a local
27 - streamlined the critical_region_fixup code to eliminate a branch
29 Signed-off-by: Jan Beulich <jbeulich@novell.com>
31 --- sle11-2009-05-14.orig/arch/x86/kernel/entry_32-xen.S 2009-05-15 08:44:13.000000000 +0200
32 +++ sle11-2009-05-14/arch/x86/kernel/entry_32-xen.S 2009-05-15 08:45:36.000000000 +0200
33 @@ -529,8 +529,8 @@ scrit: /**** START OF CRITICAL REGION **
35 14: __DISABLE_INTERRUPTS
38 ecrit: /**** END OF CRITICAL REGION ****/
43 @@ -788,17 +788,23 @@ ENTRY(hypervisor_callback)
45 CFI_ADJUST_CFA_OFFSET 4
54 jb critical_region_fixup
56 +#ifdef CONFIG_XEN_SUPERVISOR_MODE_KERNEL
57 cmpl $sysexit_scrit,%eax
60 cmpl $sysexit_ecrit,%eax
63 addl $OLDESP,%esp # Remove eflags...ebx from stack frame.
68 CFI_ADJUST_CFA_OFFSET 4
71 @@ -814,39 +820,35 @@ ENTRY(hypervisor_callback)
72 # provides the number of bytes which have already been popped from the
73 # interrupted stack frame.
74 critical_region_fixup:
75 - movzbl critical_fixup_table-scrit(%eax),%ecx # %eax contains num bytes popped
76 - cmpb $0xff,%cl # 0xff => vcpu_info critical region
79 -15: leal (%esp,%ecx),%esi # %esi points at end of src region
80 + movsbl critical_fixup_table-scrit(%eax),%ecx # %ecx contains num slots popped
82 + leal (%esp,%ecx,4),%esi # %esi points at end of src region
83 leal OLDESP(%esp),%edi # %edi points at end of dst region
84 - shrl $2,%ecx # convert words to bytes
85 - je 17f # skip loop if nothing to copy
86 + jle 17f # skip loop if nothing to copy
87 16: subl $4,%esi # pre-decrementing copy loop
92 17: movl %edi,%esp # final %edi is top of merged stack
98 - .byte 0xff,0xff,0xff # testb $0xff,(%esi) = __TEST_PENDING
99 - .byte 0xff,0xff # jnz 14f
100 - .byte 0x00 # pop %ebx
101 - .byte 0x04 # pop %ecx
102 - .byte 0x08 # pop %edx
103 - .byte 0x0c # pop %esi
104 - .byte 0x10 # pop %edi
105 - .byte 0x14 # pop %ebp
106 - .byte 0x18 # pop %eax
107 - .byte 0x1c # pop %ds
108 - .byte 0x20 # pop %es
109 - .byte 0x24,0x24,0x24 # add $4,%esp
111 - .byte 0xff,0xff,0xff,0xff # movb $1,1(%esi)
112 - .byte 0x00,0x00 # jmp 11b
113 + .byte -1,-1,-1 # testb $0xff,(%esi) = __TEST_PENDING
114 + .byte -1,-1 # jnz 14f
124 + .byte 9,9,9 # add $4,%esp
126 + .byte -1,-1,-1,-1 # movb $1,1(%esi) = __DISABLE_INTERRUPTS
129 # Hypervisor uses this for application faults while it executes.