| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 5 Feb 2018 23:53:12 -0800
From: Dan Williams <dan.j.williams@...el.com>
To: Ingo Molnar <mingo@...nel.org>
Cc: Thomas Gleixner <tglx@...utronix.de>,
Andi Kleen <ak@...ux.intel.com>,
"the arch/x86 maintainers" <x86@...nel.org>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Ingo Molnar <mingo@...hat.com>,
Andy Lutomirski <luto@...nel.org>,
"H. Peter Anvin" <hpa@...or.com>,
Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH v3 3/3] x86/entry: Clear registers for compat syscalls
On Mon, Feb 5, 2018 at 11:26 PM, Ingo Molnar <mingo@...nel.org> wrote:
>
> * Dan Williams <dan.j.williams@...el.com> wrote:
>
>> From: Andi Kleen <ak@...ux.intel.com>
>>
>> At entry userspace may have populated registers with values that could
>> be useful in a speculative execution attack. Clear them to minimize the
>> kernel's attack surface.
>>
>> [djbw: interleave the clearing with setting up the stack ]
>> Cc: Thomas Gleixner <tglx@...utronix.de>
>> Cc: Ingo Molnar <mingo@...hat.com>
>> Cc: "H. Peter Anvin" <hpa@...or.com>
>> Cc: x86@...nel.org
>> Cc: Andy Lutomirski <luto@...nel.org>
>> Signed-off-by: Andi Kleen <ak@...ux.intel.com>
>> Signed-off-by: Dan Williams <dan.j.williams@...el.com>
>> ---
>> arch/x86/entry/entry_64_compat.S | 30 ++++++++++++++++++++++++++++++
>> 1 file changed, 30 insertions(+)
>>
>> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
>> index 98d5358e4041..fd65e016e413 100644
>> --- a/arch/x86/entry/entry_64_compat.S
>> +++ b/arch/x86/entry/entry_64_compat.S
>> @@ -85,15 +85,25 @@ ENTRY(entry_SYSENTER_compat)
>> pushq %rcx /* pt_regs->cx */
>> pushq $-ENOSYS /* pt_regs->ax */
>> pushq $0 /* pt_regs->r8 = 0 */
>> + xorq %r8, %r8 /* nospec r8 */
>> pushq $0 /* pt_regs->r9 = 0 */
>> + xorq %r9, %r9 /* nospec r9 */
>> pushq $0 /* pt_regs->r10 = 0 */
>> + xorq %r10, %r10 /* nospec r10 */
>> pushq $0 /* pt_regs->r11 = 0 */
>> + xorq %r11, %r11 /* nospec r11 */
>> pushq %rbx /* pt_regs->rbx */
>> + xorl %ebx, %ebx /* nospec rbx */
>> pushq %rbp /* pt_regs->rbp (will be overwritten) */
>> + xorl %ebp, %ebp /* nospec rbp */
>> pushq $0 /* pt_regs->r12 = 0 */
>> + xorq %r12, %r12 /* nospec r12 */
>> pushq $0 /* pt_regs->r13 = 0 */
>> + xorq %r13, %r13 /* nospec r13 */
>> pushq $0 /* pt_regs->r14 = 0 */
>> + xorq %r14, %r14 /* nospec r14 */
>> pushq $0 /* pt_regs->r15 = 0 */
>> + xorq %r15, %r15 /* nospec r15 */
>> cld
>>
>> /*
>> @@ -214,15 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
>> pushq %rbp /* pt_regs->cx (stashed in bp) */
>> pushq $-ENOSYS /* pt_regs->ax */
>> pushq $0 /* pt_regs->r8 = 0 */
>> + xorq %r8, %r8 /* nospec r8 */
>> pushq $0 /* pt_regs->r9 = 0 */
>> + xorq %r9, %r9 /* nospec r9 */
>> pushq $0 /* pt_regs->r10 = 0 */
>> + xorq %r10, %r10 /* nospec r10 */
>> pushq $0 /* pt_regs->r11 = 0 */
>> + xorq %r11, %r11 /* nospec r11 */
>> pushq %rbx /* pt_regs->rbx */
>> + xorl %ebx, %ebx /* nospec rbx */
>> pushq %rbp /* pt_regs->rbp (will be overwritten) */
>> + xorl %ebp, %ebp /* nospec rbp */
>> pushq $0 /* pt_regs->r12 = 0 */
>> + xorq %r12, %r12 /* nospec r12 */
>> pushq $0 /* pt_regs->r13 = 0 */
>> + xorq %r13, %r13 /* nospec r13 */
>> pushq $0 /* pt_regs->r14 = 0 */
>> + xorq %r14, %r14 /* nospec r14 */
>> pushq $0 /* pt_regs->r15 = 0 */
>> + xorq %r15, %r15 /* nospec r15 */
>
> I really love it how you've aligned the comment fields vertically - nice!
>
>> /*
>> * User mode is traced as though IRQs are on, and SYSENTER
>> @@ -338,15 +358,25 @@ ENTRY(entry_INT80_compat)
>> pushq %rcx /* pt_regs->cx */
>> pushq $-ENOSYS /* pt_regs->ax */
>> pushq $0 /* pt_regs->r8 = 0 */
>> + xorq %r8, %r8 /* nospec r8 */
>> pushq $0 /* pt_regs->r9 = 0 */
>> + xorq %r9, %r9 /* nospec r9 */
>> pushq $0 /* pt_regs->r10 = 0 */
>> + xorq %r10, %r10 /* nospec r10 */
>> pushq $0 /* pt_regs->r11 = 0 */
>> + xorq %r11, %r11 /* nospec r11 */
>> pushq %rbx /* pt_regs->rbx */
>> + xorl %ebx, %ebx /* nospec rbx */
>> pushq %rbp /* pt_regs->rbp */
>> + xorl %ebp, %ebp /* nospec rbp */
>> pushq %r12 /* pt_regs->r12 */
>> + xorq %r12, %r12 /* nospec r12 */
>> pushq %r13 /* pt_regs->r13 */
>> + xorq %r13, %r13 /* nospec r13 */
>> pushq %r14 /* pt_regs->r14 */
>> + xorq %r14, %r14 /* nospec r14 */
>> pushq %r15 /* pt_regs->r15 */
>> + xorq %r15, %r15 /* nospec r15 */
>> cld
>
> BTW., these last two patches have changed *significantly* from Andi's original
> patches that were submitted originally, so I changed them over to:
>
> From: Dan Williams <dan.j.williams@...el.com>
> ...
> Originally-From: Andi Kleen <ak@...ux.intel.com>
> Signed-off-by: Dan Williams <dan.j.williams@...el.com>
>
> ... to better show authorship history.
>
> Please let me know if that's not OK.
Works for me.
Thanks Ingo.
Powered by blists - more mailing lists