| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 12 Jan 2018 10:45:50 -0800
From: Andi Kleen <andi@...stfloor.org>
To: tglx@...utronix.de
Cc: x86@...nel.org, dwmw@...zon.co.uk, linux-kernel@...r.kernel.org,
pjt@...gle.com, torvalds@...ux-foundation.org,
gregkh@...ux-foundation.org, peterz@...radead.org,
luto@...capital.net, thomas.lendacky@....com,
arjan.van.de.ven@...el.com, Andi Kleen <ak@...ux.intel.com>
Subject: [PATCH 4/4] x86/retpoline: Fill return buffer on interrupt return to kernel
From: Andi Kleen <ak@...ux.intel.com>
Interrupts can have rather deep call chains on top of the original
call chain. Fill the return buffer on Skylake when returning from
an interrupt to the kernel, to avoid return buffer underflows
later.
This only needs to be done when returning to the kernel,
so interrupts interrupting user space are not impacted.
Signed-off-by: Andi Kleen <ak@...ux.intel.com>
---
arch/x86/entry/entry_32.S | 16 +++++++++++++---
arch/x86/entry/entry_64.S | 22 ++++++++++++++++++++++
2 files changed, 35 insertions(+), 3 deletions(-)
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index bbecb7c2f6cb..a58b0ae7121c 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -65,7 +65,6 @@
# define preempt_stop(clobbers) DISABLE_INTERRUPTS(clobbers); TRACE_IRQS_OFF
#else
# define preempt_stop(clobbers)
-# define resume_kernel restore_all
#endif
.macro TRACE_IRQS_IRET
@@ -349,8 +348,17 @@ ENTRY(resume_userspace)
jmp restore_all
END(ret_from_exception)
-#ifdef CONFIG_PREEMPT
ENTRY(resume_kernel)
+ /*
+ * Interrupts/faults could cause the return buffer of the CPU
+ * to overflow, which would lead to a underflow later,
+ * which may lead to a uncontrolled indirect branch.
+ * Fill the return buffer when returning to the kernel.
+ */
+ FILL_RETURN_BUFFER %eax, RSB_FILL_LOOPS, X86_FEATURE_RETURN_UNDERFLOW
+5:
+
+#ifdef CONFIG_PREEMPT
DISABLE_INTERRUPTS(CLBR_ANY)
.Lneed_resched:
cmpl $0, PER_CPU_VAR(__preempt_count)
@@ -359,8 +367,10 @@ ENTRY(resume_kernel)
jz restore_all
call preempt_schedule_irq
jmp .Lneed_resched
-END(resume_kernel)
+#else
+ jmp restore_all
#endif
+END(resume_kernel)
GLOBAL(__begin_SYSENTER_singlestep_region)
/*
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 3caac129cd07..36ee97fac6af 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -792,6 +792,15 @@ retint_kernel:
TRACE_IRQS_IRETQ
GLOBAL(restore_regs_and_return_to_kernel)
+ /*
+ * Interrupts/faults could cause the return buffer of the CPU
+ * to overflow, which would lead to a underflow later,
+ * which may lead to a uncontrolled indirect branch.
+ * Fill the return buffer when returning to the kernel.
+ */
+ FILL_RETURN_BUFFER %rax, RSB_FILL_LOOPS, X86_FEATURE_RETURN_UNDERFLOW
+4:
+
#ifdef CONFIG_DEBUG_ENTRY
/* Assert that pt_regs indicates kernel mode. */
testb $3, CS(%rsp)
@@ -1660,6 +1669,10 @@ nested_nmi:
nested_nmi_out:
popq %rdx
+ /*
+ * No need to clear return buffer here because the outter NMI will do it,
+ * and we assume two NMIs will not overflow the return buffer.
+ */
/* We are returning to kernel mode, so this cannot result in a fault. */
iretq
@@ -1757,6 +1770,15 @@ end_repeat_nmi:
nmi_swapgs:
SWAPGS_UNSAFE_STACK
nmi_restore:
+ /*
+ * NMI could cause the return buffer of the CPU
+ * to overflow, which would lead to a underflow later,
+ * which may lead to a uncontrolled indirect branch.
+ * Fill the return buffer when returning to the kernel.
+ */
+
+ FILL_RETURN_BUFFER %rax, RSB_FILL_LOOPS, X86_FEATURE_RETURN_UNDERFLOW
+5:
POP_EXTRA_REGS
POP_C_REGS
--
2.14.3
Powered by blists - more mailing lists