| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103 |
- From 50b7c841936979bee6b14253999518e0cf7b3523 Mon Sep 17 00:00:00 2001
- From: Andy Lutomirski <[email protected]>
- Date: Thu, 2 Nov 2017 00:59:14 -0700
- Subject: [PATCH 102/232] x86/entry/64: Remove all remaining direct
- thread_struct::sp0 reads
- MIME-Version: 1.0
- Content-Type: text/plain; charset=UTF-8
- Content-Transfer-Encoding: 8bit
- CVE-2017-5754
- The only remaining readers in context switch code or vm86(), and
- they all just want to update TSS.sp0 to match the current task.
- Replace them all with a new helper update_sp0().
- Signed-off-by: Andy Lutomirski <[email protected]>
- Reviewed-by: Borislav Petkov <[email protected]>
- Cc: Borislav Petkov <[email protected]>
- Cc: Brian Gerst <[email protected]>
- Cc: Dave Hansen <[email protected]>
- Cc: Linus Torvalds <[email protected]>
- Cc: Peter Zijlstra <[email protected]>
- Cc: Thomas Gleixner <[email protected]>
- Link: http://lkml.kernel.org/r/2d231687f4ff288c9d9e98d7861b7df374246ac3.1509609304.git.luto@kernel.org
- Signed-off-by: Ingo Molnar <[email protected]>
- (cherry picked from commit 46f5a10a721ce8dce8cc8fe55279b49e1c6b3288)
- Signed-off-by: Andy Whitcroft <[email protected]>
- Signed-off-by: Kleber Sacilotto de Souza <[email protected]>
- (cherry picked from commit cc87284caa7d31d9d5a55c418eb5278cab6e2db1)
- Signed-off-by: Fabian Grünbichler <[email protected]>
- ---
- arch/x86/include/asm/switch_to.h | 6 ++++++
- arch/x86/kernel/process_32.c | 2 +-
- arch/x86/kernel/process_64.c | 2 +-
- arch/x86/kernel/vm86_32.c | 4 ++--
- 4 files changed, 10 insertions(+), 4 deletions(-)
- diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
- index 7ae8caffbada..54e64d909725 100644
- --- a/arch/x86/include/asm/switch_to.h
- +++ b/arch/x86/include/asm/switch_to.h
- @@ -84,4 +84,10 @@ static inline void refresh_sysenter_cs(struct thread_struct *thread)
- }
- #endif
-
- +/* This is used when switching tasks or entering/exiting vm86 mode. */
- +static inline void update_sp0(struct task_struct *task)
- +{
- + load_sp0(task->thread.sp0);
- +}
- +
- #endif /* _ASM_X86_SWITCH_TO_H */
- diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
- index 48a3f240f565..c0d60420466c 100644
- --- a/arch/x86/kernel/process_32.c
- +++ b/arch/x86/kernel/process_32.c
- @@ -287,7 +287,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- * current_thread_info(). Refresh the SYSENTER configuration in
- * case prev or next is vm86.
- */
- - load_sp0(next->sp0);
- + update_sp0(next_p);
- refresh_sysenter_cs(next);
- this_cpu_write(cpu_current_top_of_stack,
- (unsigned long)task_stack_page(next_p) +
- diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
- index 37b933628a8b..8a748e17bf6e 100644
- --- a/arch/x86/kernel/process_64.c
- +++ b/arch/x86/kernel/process_64.c
- @@ -466,7 +466,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
- this_cpu_write(current_task, next_p);
-
- /* Reload sp0. */
- - load_sp0(next->sp0);
- + update_sp0(next_p);
-
- /*
- * Now maybe reload the debug registers and handle I/O bitmaps
- diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
- index 0f1d92cd20ad..a7b44c75c642 100644
- --- a/arch/x86/kernel/vm86_32.c
- +++ b/arch/x86/kernel/vm86_32.c
- @@ -148,7 +148,7 @@ void save_v86_state(struct kernel_vm86_regs *regs, int retval)
- preempt_disable();
- tsk->thread.sp0 = vm86->saved_sp0;
- tsk->thread.sysenter_cs = __KERNEL_CS;
- - load_sp0(tsk->thread.sp0);
- + update_sp0(tsk);
- refresh_sysenter_cs(&tsk->thread);
- vm86->saved_sp0 = 0;
- preempt_enable();
- @@ -373,7 +373,7 @@ static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
- refresh_sysenter_cs(&tsk->thread);
- }
-
- - load_sp0(tsk->thread.sp0);
- + update_sp0(tsk);
- preempt_enable();
-
- if (vm86->flags & VM86_SCREEN_BITMAP)
- --
- 2.14.2
|
