linux-kernel - [PATCH] i386: Fix machine_check entry point in entry.S to not dereference kernel memory from user space context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20061109142159.GA4200@hmsreliant.homelinux.net>
Date:	Thu, 9 Nov 2006 09:21:59 -0500
From:	Neil Horman <nhorman@...driver.com>
To:	linux-kernel@...r.kernel.org, alan@...hat.com,
	davej@...emonkey.org.uk, akpm@...l.org
Cc:	nhorman@...driver.com
Subject: [PATCH] i386: Fix machine_check entry point in entry.S to not dereference kernel memory from user space context

Hey-
        It appears that when the i386 arch traps on a machine check, the code in 
entry.S loads the vector pointed to by the machine_check_vector kernel varialbe.  
Since this happens before the switch to the kernel context in error_code, the 
result is an oops, if the reverenced address is unmapped, or silent memory 
corruption if the address is mapped.  This patch corrects that, by jumping 
instead to a statically allocated kernel function instead, allowing us to load a 
static value, rather than the contents of a memory address before the switch to 
kernel context, like all of our other entry points do.

Thanks & Regards
Neil

Signed-off-by: Neil Horman <nhorman@...driver.com>


 cpu/mcheck/mce.c |    5 +++++
 cpu/mcheck/mce.h |    1 +
 entry.S          |    2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)


diff --git a/arch/i386/kernel/cpu/mcheck/mce.c b/arch/i386/kernel/cpu/mcheck/mce.c
index d555bec..a8e8e80 100644
--- a/arch/i386/kernel/cpu/mcheck/mce.c
+++ b/arch/i386/kernel/cpu/mcheck/mce.c
@@ -29,6 +29,11 @@ static fastcall void unexpected_machine_
 /* Call the installed machine check handler for this CPU setup. */
 void fastcall (*machine_check_vector)(struct pt_regs *, long error_code) = unexpected_machine_check;
 
+asmlinkage void do_machine_check(struct pt_regs *regs, long error_code)
+{
+	machine_check_vector(regs, error_code);
+}
+
 /* This has to be run for each processor */
 void mcheck_init(struct cpuinfo_x86 *c)
 {
diff --git a/arch/i386/kernel/cpu/mcheck/mce.h b/arch/i386/kernel/cpu/mcheck/mce.h
index 84fd4cf..0e7003f 100644
--- a/arch/i386/kernel/cpu/mcheck/mce.h
+++ b/arch/i386/kernel/cpu/mcheck/mce.h
@@ -8,6 +8,7 @@ void winchip_mcheck_init(struct cpuinfo_
 
 /* Call the installed machine check handler for this CPU setup. */
 extern fastcall void (*machine_check_vector)(struct pt_regs *, long error_code);
+extern asmlinkage void do_machine_check(struct pt_regs *, long error_code);
 
 extern int mce_disabled;
 extern int nr_mce_banks;
diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S
index 5a63d6f..19a2929 100644
--- a/arch/i386/kernel/entry.S
+++ b/arch/i386/kernel/entry.S
@@ -928,7 +928,7 @@ ENTRY(machine_check)
 	RING0_INT_FRAME
 	pushl $0
 	CFI_ADJUST_CFA_OFFSET 4
-	pushl machine_check_vector
+	pushl $do_machine_check
 	CFI_ADJUST_CFA_OFFSET 4
 	jmp error_code
 	CFI_ENDPROC
-- 
/***************************************************
 *Neil Horman
 *Software Engineer
 *gpg keyid: 1024D / 0x92A74FA1 - http://pgp.mit.edu
 ***************************************************/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/