linux-kernel - Re: [PATCH v2 05/36] x86/entry/64/compat: Fix SYSENTER's NT flag before user memory access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMzpN2iYzFoNGSyejUdszgUqhmijj2=0YOmc3LAnMO8xcVUdsw@mail.gmail.com>
Date:	Wed, 7 Oct 2015 10:33:10 -0400
From:	Brian Gerst <brgerst@...il.com>
To:	Borislav Petkov <bp@...en8.de>
Cc:	Andy Lutomirski <luto@...nel.org>,
	"the arch/x86 maintainers" <x86@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Denys Vlasenko <dvlasenk@...hat.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH v2 05/36] x86/entry/64/compat: Fix SYSENTER's NT flag
 before user memory access

On Wed, Oct 7, 2015 at 7:10 AM, Borislav Petkov <bp@...en8.de> wrote:
> On Mon, Oct 05, 2015 at 05:47:53PM -0700, Andy Lutomirski wrote:
>> Clearing NT is part of the prologue, whereas loading up arg6 makes
>> more sense to think about as part of syscall processing.  Reorder
>> them.
>>
>> Signed-off-by: Andy Lutomirski <luto@...nel.org>
>> ---
>>  arch/x86/entry/entry_64_compat.S | 18 +++++++++---------
>>  1 file changed, 9 insertions(+), 9 deletions(-)
>>
>> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
>> index a9360d40fb7f..aa76864a8a6b 100644
>> --- a/arch/x86/entry/entry_64_compat.S
>> +++ b/arch/x86/entry/entry_64_compat.S
>> @@ -89,15 +89,6 @@ ENTRY(entry_SYSENTER_compat)
>>       sub     $(10*8), %rsp /* pt_regs->r8-11, bp, bx, r12-15 not saved */
>>
>>       /*
>> -      * no need to do an access_ok check here because rbp has been
>> -      * 32-bit zero extended
>> -      */
>> -     ASM_STAC
>> -1:   movl    (%rbp), %ebp
>> -     _ASM_EXTABLE(1b, ia32_badarg)
>> -     ASM_CLAC
>> -
>> -     /*
>>        * Sysenter doesn't filter flags, so we need to clear NT
>>        * ourselves.  To save a few cycles, we can check whether
>>        * NT was set instead of doing an unconditional popfq.
>> @@ -106,6 +97,15 @@ ENTRY(entry_SYSENTER_compat)
>>       jnz     sysenter_fix_flags
>>  sysenter_flags_fixed:
>
> Btw, do I see it correctly that we can save us this jumping to
> sysenter_fix_flags and back to sysenter_flags_fixed? Label is jumped to
> only once and the couple of insns there can be behind a JZ...

This is an optimization, since NT is unlikely to be set.  The forward
branch is usually predicted as not taken, and it keeps these rarely
used instructions out of the hot cache.

--
Brian Gerst
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/