linux-kernel - Re: [PATCH] x86/entry/64/compat: Fix "x86/entry/64/compat: Preserve r8-r11 in int $0x80"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 27 Jun 2018 16:51:08 +0800
From:   Li Zhijian <zhijianx.li@...el.com>
To:     Andy Lutomirski <luto@...nel.org>, x86@...nel.org,
        LKML <linux-kernel@...r.kernel.org>
Cc:     Borislav Petkov <bp@...en8.de>, stable@...r.kernel.org
Subject: Re: [PATCH] x86/entry/64/compat: Fix "x86/entry/64/compat: Preserve
 r8-r11 in int $0x80"


On 6/27/2018 1:45 PM, Andy Lutomirski wrote:
> Commit 8bb2610bc496 ("x86/entry/64/compat: Preserve r8-r11 in int
> $0x80") was busted.  My original patch had a minor conflict with
> some of the nospec changes.  git apply is very clever and silently
> accepted the patch by making the same changes to a different
> function in the same file.  There was obviously a huge offset, but
> git apply for some reason doesn't feel any need to say so.
>
> Move the changes to the correct function.  Now the
> test_syscall_vdso_32 selftests passes.
>
> If anyone cares to observe the original problem, try applying the
> patch at
> https://lore.kernel.org/lkml/d4c4d9985fbe64f8c9e19291886453914b48caee.1523975710.git.luto@kernel.org/raw
> to the kernel at 316d097c4cd4e7f2ef50c40cff2db266593c4ec4.  git am and
> git apply accept the patch without any complaints at all.  patch -p1
> at least prints out a message about the huge offset.
>
> Reported-by: zhijianx.li@...el.com
> Fixes: 8bb2610bc496 ("x86/entry/64/compat: Preserve r8-r11 in int $0x80")
> Cc: stable@...r.kernel.org
> Signed-off-by: Andy Lutomirski <luto@...nel.org>

Tested-by: Li Zhijian <zhijianx.li@...el.com>


> ---
>   arch/x86/entry/entry_64_compat.S | 16 ++++++++--------
>   1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
> index 9de7f1e1dede..7d0df78db727 100644
> --- a/arch/x86/entry/entry_64_compat.S
> +++ b/arch/x86/entry/entry_64_compat.S
> @@ -84,13 +84,13 @@ ENTRY(entry_SYSENTER_compat)
>   	pushq	%rdx			/* pt_regs->dx */
>   	pushq	%rcx			/* pt_regs->cx */
>   	pushq	$-ENOSYS		/* pt_regs->ax */
> -	pushq   %r8			/* pt_regs->r8 */
> +	pushq   $0			/* pt_regs->r8  = 0 */
>   	xorl	%r8d, %r8d		/* nospec   r8 */
> -	pushq   %r9			/* pt_regs->r9 */
> +	pushq   $0			/* pt_regs->r9  = 0 */
>   	xorl	%r9d, %r9d		/* nospec   r9 */
> -	pushq   %r10			/* pt_regs->r10 */
> +	pushq   $0			/* pt_regs->r10 = 0 */
>   	xorl	%r10d, %r10d		/* nospec   r10 */
> -	pushq   %r11			/* pt_regs->r11 */
> +	pushq   $0			/* pt_regs->r11 = 0 */
>   	xorl	%r11d, %r11d		/* nospec   r11 */
>   	pushq   %rbx                    /* pt_regs->rbx */
>   	xorl	%ebx, %ebx		/* nospec   rbx */
> @@ -374,13 +374,13 @@ ENTRY(entry_INT80_compat)
>   	pushq	%rcx			/* pt_regs->cx */
>   	xorl	%ecx, %ecx		/* nospec   cx */
>   	pushq	$-ENOSYS		/* pt_regs->ax */
> -	pushq   $0			/* pt_regs->r8  = 0 */
> +	pushq   %r8			/* pt_regs->r8 */
>   	xorl	%r8d, %r8d		/* nospec   r8 */
> -	pushq   $0			/* pt_regs->r9  = 0 */
> +	pushq   %r9			/* pt_regs->r9 */
>   	xorl	%r9d, %r9d		/* nospec   r9 */
> -	pushq   $0			/* pt_regs->r10 = 0 */
> +	pushq   %r10			/* pt_regs->r10*/
>   	xorl	%r10d, %r10d		/* nospec   r10 */
> -	pushq   $0			/* pt_regs->r11 = 0 */
> +	pushq   %r11			/* pt_regs->r11 */
>   	xorl	%r11d, %r11d		/* nospec   r11 */
>   	pushq   %rbx                    /* pt_regs->rbx */
>   	xorl	%ebx, %ebx		/* nospec   rbx */