From: Greg Kroah-Hartman Date: Mon, 18 Sep 2017 06:58:03 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.9.51~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=99eb93fdd0dbee59e73e07b5e9bddce537625cdc;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch --- diff --git a/queue-4.4/series b/queue-4.4/series index 3af64de93f2..af337b0500b 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -10,3 +10,5 @@ gianfar-fix-tx-flow-control-deactivation.patch ipv6-fix-memory-leak-with-multiple-tables-during-netns-destruction.patch ipv6-fix-typo-in-fib6_net_exit.patch f2fs-check-hot_data-for-roll-forward-recovery.patch +x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch +x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch diff --git a/queue-4.4/x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch b/queue-4.4/x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch new file mode 100644 index 00000000000..cee2485f774 --- /dev/null +++ b/queue-4.4/x86-fsgsbase-64-fully-initialize-fs-and-gs-state-in-start_thread_common.patch @@ -0,0 +1,58 @@ +From 767d035d838f4fd6b5a5bbd7a3f6d293b7f65a49 Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Tue, 1 Aug 2017 07:11:34 -0700 +Subject: x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common + +From: Andy Lutomirski + +commit 767d035d838f4fd6b5a5bbd7a3f6d293b7f65a49 upstream. + +execve used to leak FSBASE and GSBASE on AMD CPUs. Fix it. + +The security impact of this bug is small but not quite zero -- it +could weaken ASLR when a privileged task execs a less privileged +program, but only if program changed bitness across the exec, or the +child binary was highly unusual or actively malicious. A child +program that was compromised after the exec would not have access to +the leaked base. + +Signed-off-by: Andy Lutomirski +Cc: Borislav Petkov +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: Chang Seok +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Josh Poimboeuf +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/process_64.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -232,10 +232,19 @@ start_thread_common(struct pt_regs *regs + unsigned long new_sp, + unsigned int _cs, unsigned int _ss, unsigned int _ds) + { ++ WARN_ON_ONCE(regs != current_pt_regs()); ++ ++ if (static_cpu_has(X86_BUG_NULL_SEG)) { ++ /* Loading zero below won't clear the base. */ ++ loadsegment(fs, __USER_DS); ++ load_gs_index(__USER_DS); ++ } ++ + loadsegment(fs, 0); + loadsegment(es, _ds); + loadsegment(ds, _ds); + load_gs_index(0); ++ + regs->ip = new_ip; + regs->sp = new_sp; + regs->cs = _cs; diff --git a/queue-4.4/x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch b/queue-4.4/x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch new file mode 100644 index 00000000000..43203b861e1 --- /dev/null +++ b/queue-4.4/x86-fsgsbase-64-report-fsbase-and-gsbase-correctly-in-core-dumps.patch @@ -0,0 +1,56 @@ +From 9584d98bed7a7a904d0702ad06bbcc94703cb5b4 Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Tue, 1 Aug 2017 07:11:35 -0700 +Subject: x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps + +From: Andy Lutomirski + +commit 9584d98bed7a7a904d0702ad06bbcc94703cb5b4 upstream. + +In ELF_COPY_CORE_REGS, we're copying from the current task, so +accessing thread.fsbase and thread.gsbase makes no sense. Just read +the values from the CPU registers. + +In practice, the old code would have been correct most of the time +simply because thread.fsbase and thread.gsbase usually matched the +CPU registers. + +Signed-off-by: Andy Lutomirski +Cc: Borislav Petkov +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: Chang Seok +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Josh Poimboeuf +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/elf.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/elf.h ++++ b/arch/x86/include/asm/elf.h +@@ -204,6 +204,7 @@ void set_personality_ia32(bool); + + #define ELF_CORE_COPY_REGS(pr_reg, regs) \ + do { \ ++ unsigned long base; \ + unsigned v; \ + (pr_reg)[0] = (regs)->r15; \ + (pr_reg)[1] = (regs)->r14; \ +@@ -226,8 +227,8 @@ do { \ + (pr_reg)[18] = (regs)->flags; \ + (pr_reg)[19] = (regs)->sp; \ + (pr_reg)[20] = (regs)->ss; \ +- (pr_reg)[21] = current->thread.fs; \ +- (pr_reg)[22] = current->thread.gs; \ ++ rdmsrl(MSR_FS_BASE, base); (pr_reg)[21] = base; \ ++ rdmsrl(MSR_KERNEL_GS_BASE, base); (pr_reg)[22] = base; \ + asm("movl %%ds,%0" : "=r" (v)); (pr_reg)[23] = v; \ + asm("movl %%es,%0" : "=r" (v)); (pr_reg)[24] = v; \ + asm("movl %%fs,%0" : "=r" (v)); (pr_reg)[25] = v; \