| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899 |
- From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
- From: Andy Lutomirski <[email protected]>
- Date: Thu, 2 Nov 2017 00:59:12 -0700
- Subject: [PATCH] x86/xen/64, x86/entry/64: Clean up SP code in
- cpu_initialize_context()
- MIME-Version: 1.0
- Content-Type: text/plain; charset=UTF-8
- Content-Transfer-Encoding: 8bit
- CVE-2017-5754
- I'm removing thread_struct::sp0, and Xen's usage of it is slightly
- dubious and unnecessary. Use appropriate helpers instead.
- While we're at at, reorder the code slightly to make it more obvious
- what's going on.
- Signed-off-by: Andy Lutomirski <[email protected]>
- Reviewed-by: Juergen Gross <[email protected]>
- Cc: Boris Ostrovsky <[email protected]>
- Cc: Borislav Petkov <[email protected]>
- Cc: Brian Gerst <[email protected]>
- Cc: Dave Hansen <[email protected]>
- Cc: Juergen Gross <[email protected]>
- Cc: Linus Torvalds <[email protected]>
- Cc: Peter Zijlstra <[email protected]>
- Cc: Thomas Gleixner <[email protected]>
- Link: http://lkml.kernel.org/r/d5b9a3da2b47c68325bd2bbe8f82d9554dee0d0f.1509609304.git.luto@kernel.org
- Signed-off-by: Ingo Molnar <[email protected]>
- (cherry picked from commit f16b3da1dc936c0f8121741d0a1731bf242f2f56)
- Signed-off-by: Andy Whitcroft <[email protected]>
- Signed-off-by: Kleber Sacilotto de Souza <[email protected]>
- (cherry picked from commit 27c60a1f6c49062151f67042458a523386cc3dc5)
- Signed-off-by: Fabian Grünbichler <[email protected]>
- ---
- arch/x86/xen/smp_pv.c | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
- diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
- index 51471408fdd1..8c0e047d0b80 100644
- --- a/arch/x86/xen/smp_pv.c
- +++ b/arch/x86/xen/smp_pv.c
- @@ -13,6 +13,7 @@
- * single-threaded.
- */
- #include <linux/sched.h>
- +#include <linux/sched/task_stack.h>
- #include <linux/err.h>
- #include <linux/slab.h>
- #include <linux/smp.h>
- @@ -293,12 +294,19 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
- #endif
- memset(&ctxt->fpu_ctxt, 0, sizeof(ctxt->fpu_ctxt));
-
- + /*
- + * Bring up the CPU in cpu_bringup_and_idle() with the stack
- + * pointing just below where pt_regs would be if it were a normal
- + * kernel entry.
- + */
- ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle;
- ctxt->flags = VGCF_IN_KERNEL;
- ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */
- ctxt->user_regs.ds = __USER_DS;
- ctxt->user_regs.es = __USER_DS;
- ctxt->user_regs.ss = __KERNEL_DS;
- + ctxt->user_regs.cs = __KERNEL_CS;
- + ctxt->user_regs.esp = (unsigned long)task_pt_regs(idle);
-
- xen_copy_trap_info(ctxt->trap_ctxt);
-
- @@ -313,8 +321,13 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
- ctxt->gdt_frames[0] = gdt_mfn;
- ctxt->gdt_ents = GDT_ENTRIES;
-
- + /*
- + * Set SS:SP that Xen will use when entering guest kernel mode
- + * from guest user mode. Subsequent calls to load_sp0() can
- + * change this value.
- + */
- ctxt->kernel_ss = __KERNEL_DS;
- - ctxt->kernel_sp = idle->thread.sp0;
- + ctxt->kernel_sp = task_top_of_stack(idle);
-
- #ifdef CONFIG_X86_32
- ctxt->event_callback_cs = __KERNEL_CS;
- @@ -326,10 +339,8 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
- (unsigned long)xen_hypervisor_callback;
- ctxt->failsafe_callback_eip =
- (unsigned long)xen_failsafe_callback;
- - ctxt->user_regs.cs = __KERNEL_CS;
- per_cpu(xen_cr3, cpu) = __pa(swapper_pg_dir);
-
- - ctxt->user_regs.esp = idle->thread.sp0 - sizeof(struct pt_regs);
- ctxt->ctrlreg[3] = xen_pfn_to_cr3(virt_to_gfn(swapper_pg_dir));
- if (HYPERVISOR_vcpu_op(VCPUOP_initialise, xen_vcpu_nr(cpu), ctxt))
- BUG();
- --
- 2.14.2
|
