linux-kernel - Re: [ 05/48] x86_64, switch_to(): Load TLS descriptors before switching DS and ES

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150515133820.GA30744@1wt.eu>
Date:	Fri, 15 May 2015 15:38:20 +0200
From:	Willy Tarreau <w@....eu>
To:	Ben Hutchings <ben@...adent.org.uk>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Andy Lutomirski <luto@...capital.net>,
	Andi Kleen <andi@...stfloor.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Ingo Molnar <mingo@...nel.org>
Subject: Re: [ 05/48] x86_64, switch_to(): Load TLS descriptors before switching DS and ES

Hi Ben,

On Fri, May 15, 2015 at 01:32:20PM +0100, Ben Hutchings wrote:
> On Fri, 2015-05-15 at 10:05 +0200, Willy Tarreau wrote:
> > 2.6.32-longterm review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Andy Lutomirski <luto@...capital.net>
> > 
> > commit f647d7c155f069c1a068030255c300663516420e upstream.
> > 
> > Otherwise, if buggy user code points DS or ES into the TLS
> > array, they would be corrupted after a context switch.
> > 
> > This also significantly improves the comments and documents some
> > gotchas in the code.
> > 
> > Before this patch, the both tests below failed.  With this
> > patch, the es test passes, although the gsbase test still fails.
> [...]
> 
> This depends on the changes to FPU/MMX/SSE state management that you
> didn't apply to 2.6.32.  Note this comment:
> 
> 	/* Must be after DS reload */
> 	unlazy_fpu(prev_p);

Are you sure you're not confusing with another one ? When running
estest without this patch, I get "FAIL: ES corrupted 1000/1000 times"
while I get "OK: ES was preserved" once applied, so it does seem to
do what it's intended for.

Also I'm not seeing any reference to the comment above in the patch
nor around it, which leaves me confused :-/

Thanks,
Willy

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/