linux-kernel - Re: [Patch V2] x86/ldt: correct fpu emulation access to ldt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 6 Aug 2015 11:13:16 +0200
From:	Juergen Gross <jgross@...e.com>
To:	billm@...bpc.org.au, tglx@...utronix.de, mingo@...hat.com,
	hpa@...or.com, x86@...nel.org, linux-kernel@...r.kernel.org,
	luto@...capital.net
Cc:	stable@...r.kernel.org
Subject: Re: [Patch V2] x86/ldt: correct fpu emulation access to ldt

Please ignore, V3 coming soon.


Juergen

On 08/06/2015 11:07 AM, Juergen Gross wrote:
> Commit 37868fe113ff ("x86/ldt: Make modify_ldt synchronous") introduced
> a new struct ldt_struct anchored at mm->context.ldt.
>
> Adapt the x86 fpu emulation to use that new structure.
>
> Cc: <stable@...r.kernel.org> # 37868fe113ff: x86/ldt: Make modify_ldt synchronous
> Cc: <stable@...r.kernel.org> # a5b9e5a2f14f: x86/ldt: Make modify_ldt optional
> Signed-off-by: Juergen Gross <jgross@...e.com>
> ---
>   arch/x86/math-emu/fpu_entry.c   |  3 +--
>   arch/x86/math-emu/fpu_system.h  | 18 +++++++++++++++---
>   arch/x86/math-emu/get_address.c |  3 +--
>   3 files changed, 17 insertions(+), 7 deletions(-)
>
> diff --git a/arch/x86/math-emu/fpu_entry.c b/arch/x86/math-emu/fpu_entry.c
> index f37e84a..203318a 100644
> --- a/arch/x86/math-emu/fpu_entry.c
> +++ b/arch/x86/math-emu/fpu_entry.c
> @@ -29,7 +29,6 @@
>
>   #include <asm/uaccess.h>
>   #include <asm/traps.h>
> -#include <asm/desc.h>
>   #include <asm/user.h>
>   #include <asm/fpu/internal.h>
>
> @@ -181,7 +180,7 @@ void math_emulate(struct math_emu_info *info)
>   			math_abort(FPU_info, SIGILL);
>   		}
>
> -		code_descriptor = LDT_DESCRIPTOR(FPU_CS);
> +		code_descriptor = *FPU_get_ldt_descriptor(FPU_CS);
>   		if (SEG_D_SIZE(code_descriptor)) {
>   			/* The above test may be wrong, the book is not clear */
>   			/* Segmented 32 bit protected mode */
> diff --git a/arch/x86/math-emu/fpu_system.h b/arch/x86/math-emu/fpu_system.h
> index 9ccecb6..9330583 100644
> --- a/arch/x86/math-emu/fpu_system.h
> +++ b/arch/x86/math-emu/fpu_system.h
> @@ -16,9 +16,21 @@
>   #include <linux/kernel.h>
>   #include <linux/mm.h>
>
> -/* s is always from a cpu register, and the cpu does bounds checking
> - * during register load --> no further bounds checks needed */
> -#define LDT_DESCRIPTOR(s)	(((struct desc_struct *)current->mm->context.ldt)[(s) >> 3])
> +#include <asm/desc.h>
> +#include <asm/mmu_context.h>
> +
> +static inline struct desc_struct *FPU_get_ldt_descriptor(unsigned seg)
> +{
> +	static struct desc_struct zero_desc;
> +
> +#ifdef CONFIG_MODIFY_LDT_SYSCALL
> +	seg >>= 3;
> +	if (seg < current->mm->context.ldt->size)
> +		return current->mm->context.ldt->entries + seg;
> +#endif
> +	return &zero_desc;
> +}
> +
>   #define SEG_D_SIZE(x)		((x).b & (3 << 21))
>   #define SEG_G_BIT(x)		((x).b & (1 << 23))
>   #define SEG_GRANULARITY(x)	(((x).b & (1 << 23)) ? 4096 : 1)
> diff --git a/arch/x86/math-emu/get_address.c b/arch/x86/math-emu/get_address.c
> index 6ef5e99..f912edd 100644
> --- a/arch/x86/math-emu/get_address.c
> +++ b/arch/x86/math-emu/get_address.c
> @@ -20,7 +20,6 @@
>   #include <linux/stddef.h>
>
>   #include <asm/uaccess.h>
> -#include <asm/desc.h>
>
>   #include "fpu_system.h"
>   #include "exception.h"
> @@ -158,7 +157,7 @@ static long pm_address(u_char FPU_modrm, u_char segment,
>   		addr->selector = PM_REG_(segment);
>   	}
>
> -	descriptor = LDT_DESCRIPTOR(PM_REG_(segment));
> +	descriptor = *FPU_get_ldt_descriptor(segment);
>   	base_address = SEG_BASE_ADDR(descriptor);
>   	address = base_address + offset;
>   	limit = base_address
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/