linux-kernel - [tip:x86/asm] x86/asm/entry/32: Simplify the zeroing of pt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tip-61b1e3e782d6784b714c0d80de529e0737d0e79c@git.kernel.org>
Date:	Sun, 7 Jun 2015 01:30:59 -0700
From:	tip-bot for Denys Vlasenko <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	luto@...capital.net, hpa@...or.com, peterz@...radead.org,
	linux-kernel@...r.kernel.org, bp@...en8.de,
	torvalds@...ux-foundation.org, fweisbec@...il.com,
	rostedt@...dmis.org, brgerst@...il.com, ast@...mgrid.com,
	tglx@...utronix.de, mingo@...nel.org, keescook@...omium.org,
	wad@...omium.org, oleg@...hat.com, dvlasenk@...hat.com,
	akpm@...ux-foundation.org
Subject: [tip:x86/asm] x86/asm/entry/32: Simplify the zeroing of pt_regs->
 r8..r11 in the int80 code path

Commit-ID:  61b1e3e782d6784b714c0d80de529e0737d0e79c
Gitweb:     http://git.kernel.org/tip/61b1e3e782d6784b714c0d80de529e0737d0e79c
Author:     Denys Vlasenko <dvlasenk@...hat.com>
AuthorDate: Tue, 2 Jun 2015 19:35:10 +0200
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Fri, 5 Jun 2015 13:22:21 +0200

x86/asm/entry/32: Simplify the zeroing of pt_regs->r8..r11 in the int80 code path

32-bit syscall entry points do not save the complete pt_regs struct,
they leave some fields uninitialized. However, they must be
careful to not leak uninitialized data in pt_regs->r8..r11 to
ptrace users.

CLEAR_RREGS macro is used to zero these fields out when needed.

However, in the int80 code path this zeroing is unconditional.
This patch simplifies it by storing zeroes there right away,
when pt_regs is constructed on stack.

This uses shorter instructions:

   text    data     bss     dec     hex filename
   1423       0       0    1423     58f ia32entry.o.before
   1407       0       0    1407     57f ia32entry.o

Compile-tested.

Signed-off-by: Denys Vlasenko <dvlasenk@...hat.com>
Cc: Alexei Starovoitov <ast@...mgrid.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Frederic Weisbecker <fweisbec@...il.com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Kees Cook <keescook@...omium.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Oleg Nesterov <oleg@...hat.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Steven Rostedt <rostedt@...dmis.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Will Drewry <wad@...omium.org>
Link: http://lkml.kernel.org/r/1433266510-2938-1-git-send-email-dvlasenk@redhat.com
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 arch/x86/entry/ia32entry.S | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/arch/x86/entry/ia32entry.S b/arch/x86/entry/ia32entry.S
index f167674..f00a409 100644
--- a/arch/x86/entry/ia32entry.S
+++ b/arch/x86/entry/ia32entry.S
@@ -421,6 +421,10 @@ ia32_badarg:
 	movq $-EFAULT,%rax
 	jmp ia32_sysret
 
+ia32_ret_from_sys_call:
+	CLEAR_RREGS
+	jmp int_ret_from_sys_call
+
 /*
  * Emulated IA32 system calls via int 0x80.
  *
@@ -462,8 +466,12 @@ ENTRY(ia32_syscall)
 	pushq	%rdx			/* pt_regs->dx */
 	pushq	%rcx			/* pt_regs->cx */
 	pushq	$-ENOSYS		/* pt_regs->ax */
+	pushq	$0			/* pt_regs->r8 */
+	pushq	$0			/* pt_regs->r9 */
+	pushq	$0			/* pt_regs->r10 */
+	pushq	$0			/* pt_regs->r11 */
 	cld
-	sub	$(10*8),%rsp /* pt_regs->r8-11,bp,bx,r12-15 not saved */
+	sub	$(6*8),%rsp /* pt_regs->bp,bx,r12-15 not saved */
 
 	orl $TS_COMPAT, ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS)
 	testl $_TIF_WORK_SYSCALL_ENTRY, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
@@ -481,13 +489,10 @@ ia32_do_call:
 ia32_sysret:
 	movq %rax,RAX(%rsp)
 1:
-ia32_ret_from_sys_call:
-	CLEAR_RREGS
 	jmp int_ret_from_sys_call
 
 ia32_tracesys:
 	SAVE_EXTRA_REGS
-	CLEAR_RREGS
 	movq %rsp,%rdi        /* &pt_regs -> arg1 */
 	call syscall_trace_enter
 	LOAD_ARGS32	/* reload args from stack in case ptrace changed it */
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/