git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 6b8cf5cc9965673951f1ab3f0e3cf23d06e3e2ee Mon Sep 17 00:00:00 2001
   2 From: Dan Williams <dan.j.williams@intel.com>
   3 Date: Mon, 5 Feb 2018 17:18:17 -0800
   4 Subject: x86/entry/64/compat: Clear registers for compat syscalls, to reduce speculation attack surface
   5
   6 From: Dan Williams <dan.j.williams@intel.com>
   7
   8 commit 6b8cf5cc9965673951f1ab3f0e3cf23d06e3e2ee upstream.
   9
  10 At entry userspace may have populated registers with values that could
  11 otherwise be useful in a speculative execution attack. Clear them to
  12 minimize the kernel's attack surface.
  13
  14 Originally-From: Andi Kleen <ak@linux.intel.com>
  15 Signed-off-by: Dan Williams <dan.j.williams@intel.com>
  16 Cc: <stable@vger.kernel.org>
  17 Cc: Andy Lutomirski <luto@kernel.org>
  18 Cc: Borislav Petkov <bp@alien8.de>
  19 Cc: Brian Gerst <brgerst@gmail.com>
  20 Cc: Denys Vlasenko <dvlasenk@redhat.com>
  21 Cc: H. Peter Anvin <hpa@zytor.com>
  22 Cc: Josh Poimboeuf <jpoimboe@redhat.com>
  23 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  24 Cc: Peter Zijlstra <peterz@infradead.org>
  25 Cc: Thomas Gleixner <tglx@linutronix.de>
  26 Link: http://lkml.kernel.org/r/151787989697.7847.4083702787288600552.stgit@dwillia2-desk3.amr.corp.intel.com
  27 [ Made small improvements to the changelog. ]
  28 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  29 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30
  31 ---
  32  arch/x86/entry/entry_64_compat.S |   30 ++++++++++++++++++++++++++++++
  33  1 file changed, 30 insertions(+)
  34
  35 --- a/arch/x86/entry/entry_64_compat.S
  36 +++ b/arch/x86/entry/entry_64_compat.S
  37 @@ -85,15 +85,25 @@ ENTRY(entry_SYSENTER_compat)
  38         pushq   %rcx                    /* pt_regs->cx */
  39         pushq   $-ENOSYS                /* pt_regs->ax */
  40         pushq   $0                      /* pt_regs->r8  = 0 */
  41 +       xorq    %r8, %r8                /* nospec   r8 */
  42         pushq   $0                      /* pt_regs->r9  = 0 */
  43 +       xorq    %r9, %r9                /* nospec   r9 */
  44         pushq   $0                      /* pt_regs->r10 = 0 */
  45 +       xorq    %r10, %r10              /* nospec   r10 */
  46         pushq   $0                      /* pt_regs->r11 = 0 */
  47 +       xorq    %r11, %r11              /* nospec   r11 */
  48         pushq   %rbx                    /* pt_regs->rbx */
  49 +       xorl    %ebx, %ebx              /* nospec   rbx */
  50         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
  51 +       xorl    %ebp, %ebp              /* nospec   rbp */
  52         pushq   $0                      /* pt_regs->r12 = 0 */
  53 +       xorq    %r12, %r12              /* nospec   r12 */
  54         pushq   $0                      /* pt_regs->r13 = 0 */
  55 +       xorq    %r13, %r13              /* nospec   r13 */
  56         pushq   $0                      /* pt_regs->r14 = 0 */
  57 +       xorq    %r14, %r14              /* nospec   r14 */
  58         pushq   $0                      /* pt_regs->r15 = 0 */
  59 +       xorq    %r15, %r15              /* nospec   r15 */
  60         cld
  61
  62         /*
  63 @@ -214,15 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwfram
  64         pushq   %rbp                    /* pt_regs->cx (stashed in bp) */
  65         pushq   $-ENOSYS                /* pt_regs->ax */
  66         pushq   $0                      /* pt_regs->r8  = 0 */
  67 +       xorq    %r8, %r8                /* nospec   r8 */
  68         pushq   $0                      /* pt_regs->r9  = 0 */
  69 +       xorq    %r9, %r9                /* nospec   r9 */
  70         pushq   $0                      /* pt_regs->r10 = 0 */
  71 +       xorq    %r10, %r10              /* nospec   r10 */
  72         pushq   $0                      /* pt_regs->r11 = 0 */
  73 +       xorq    %r11, %r11              /* nospec   r11 */
  74         pushq   %rbx                    /* pt_regs->rbx */
  75 +       xorl    %ebx, %ebx              /* nospec   rbx */
  76         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
  77 +       xorl    %ebp, %ebp              /* nospec   rbp */
  78         pushq   $0                      /* pt_regs->r12 = 0 */
  79 +       xorq    %r12, %r12              /* nospec   r12 */
  80         pushq   $0                      /* pt_regs->r13 = 0 */
  81 +       xorq    %r13, %r13              /* nospec   r13 */
  82         pushq   $0                      /* pt_regs->r14 = 0 */
  83 +       xorq    %r14, %r14              /* nospec   r14 */
  84         pushq   $0                      /* pt_regs->r15 = 0 */
  85 +       xorq    %r15, %r15              /* nospec   r15 */
  86
  87         /*
  88          * User mode is traced as though IRQs are on, and SYSENTER
  89 @@ -338,15 +358,25 @@ ENTRY(entry_INT80_compat)
  90         pushq   %rcx                    /* pt_regs->cx */
  91         pushq   $-ENOSYS                /* pt_regs->ax */
  92         pushq   $0                      /* pt_regs->r8  = 0 */
  93 +       xorq    %r8, %r8                /* nospec   r8 */
  94         pushq   $0                      /* pt_regs->r9  = 0 */
  95 +       xorq    %r9, %r9                /* nospec   r9 */
  96         pushq   $0                      /* pt_regs->r10 = 0 */
  97 +       xorq    %r10, %r10              /* nospec   r10 */
  98         pushq   $0                      /* pt_regs->r11 = 0 */
  99 +       xorq    %r11, %r11              /* nospec   r11 */
 100         pushq   %rbx                    /* pt_regs->rbx */
 101 +       xorl    %ebx, %ebx              /* nospec   rbx */
 102         pushq   %rbp                    /* pt_regs->rbp */
 103 +       xorl    %ebp, %ebp              /* nospec   rbp */
 104         pushq   %r12                    /* pt_regs->r12 */
 105 +       xorq    %r12, %r12              /* nospec   r12 */
 106         pushq   %r13                    /* pt_regs->r13 */
 107 +       xorq    %r13, %r13              /* nospec   r13 */
 108         pushq   %r14                    /* pt_regs->r14 */
 109 +       xorq    %r14, %r14              /* nospec   r14 */
 110         pushq   %r15                    /* pt_regs->r15 */
 111 +       xorq    %r15, %r15              /* nospec   r15 */
 112         cld
 113
 114         /*