linux-kernel - Re: [Stable-review] [046/127] KVM: VMX: Fix host userspace gsbase corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 08 Dec 2010 02:12:17 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Greg KH <gregkh@...e.de>
Cc:	linux-kernel@...r.kernel.org, stable@...nel.org, greg@...ah.com,
	avi@...hat.com, akpm@...ux-foundation.org,
	torvalds@...ux-foundation.org, stable-review@...nel.org,
	alan@...rguk.ukuu.org.uk
Subject: Re: [Stable-review] [046/127] KVM: VMX: Fix host userspace gsbase
 corruption

On Tue, 2010-12-07 at 16:43 -0800, Greg KH wrote:
> 2.6.32-stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> 
> From: Ben Hutchings <ben@...adent.org.uk>

This should be credited primarily to Avi.

Ben.

> commit c8770e7ba63bb5dd8fe5f9d251275a8fa717fb78 upstream.
> 
> We now use load_gs_index() to load gs safely; unfortunately this also
> changes MSR_KERNEL_GS_BASE, which we managed separately.  This resulted
> in confusion and breakage running 32-bit host userspace on a 64-bit kernel.
> 
> Fix by
> - saving guest MSR_KERNEL_GS_BASE before we we reload the host's gs
> - doing the host save/load unconditionally, instead of only when in guest
>   long mode
> 
> Things can be cleaned up further, but this is the minmal fix for now.
> 
> Signed-off-by: Avi Kivity <avi@...hat.com>
> Signed-off-by: Marcelo Tosatti <mtosatti@...hat.com>
> [bwh: Backport to 2.6.32]
> Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>
[...]

-- 
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)