linux-kernel - [tip:x86/urgent] x86/entry/64/compat: Fix stack switching for XEN PV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tip-fc24d75a7f91837d7918e40719575951820b2b8f@git.kernel.org>
Date:   Thu, 17 Jan 2019 15:42:56 -0800
From:   tip-bot for Jan Beulich <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     luto@...nel.org, linux-kernel@...r.kernel.org, jbeulich@...e.com,
        mingo@...nel.org, boris.ostrovsky@...cle.com, hpa@...or.com,
        JBeulich@...e.com, tglx@...utronix.de, jgross@...e.com
Subject: [tip:x86/urgent] x86/entry/64/compat: Fix stack switching for XEN
 PV

Commit-ID:  fc24d75a7f91837d7918e40719575951820b2b8f
Gitweb:     https://git.kernel.org/tip/fc24d75a7f91837d7918e40719575951820b2b8f
Author:     Jan Beulich <JBeulich@...e.com>
AuthorDate: Tue, 15 Jan 2019 09:58:16 -0700
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Fri, 18 Jan 2019 00:39:33 +0100

x86/entry/64/compat: Fix stack switching for XEN PV

While in the native case entry into the kernel happens on the trampoline
stack, PV Xen kernels get entered with the current thread stack right
away. Hence source and destination stacks are identical in that case,
and special care is needed.

Other than in sync_regs() the copying done on the INT80 path isn't
NMI / #MC safe, as either of these events occurring in the middle of the
stack copying would clobber data on the (source) stack.

There is similar code in interrupt_entry() and nmi(), but there is no fixup
required because those code paths are unreachable in XEN PV guests.

[ tglx: Sanitized subject, changelog, Fixes tag and stable mail address. Sigh ]

Fixes: 7f2590a110b8 ("x86/entry/64: Use a per-CPU trampoline stack for IDT entries")
Signed-off-by: Jan Beulich <jbeulich@...e.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Reviewed-by: Juergen Gross <jgross@...e.com>
Acked-by: Andy Lutomirski <luto@...nel.org>
Cc: Peter Anvin <hpa@...or.com>
Cc: xen-devel@...ts.xenproject.org>
Cc: Boris Ostrovsky <boris.ostrovsky@...cle.com>
Cc: stable@...r.kernel.org
Link: https://lkml.kernel.org/r/5C3E1128020000780020DFAD@prv1-mh.provo.novell.com

---
 arch/x86/entry/entry_64_compat.S | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 8eaf8952c408..39913770a44d 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -361,7 +361,8 @@ ENTRY(entry_INT80_compat)
 
 	/* Need to switch before accessing the thread stack. */
 	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
-	movq	%rsp, %rdi
+	/* In the Xen PV case we already run on the thread stack. */
+	ALTERNATIVE "movq %rsp, %rdi", "jmp .Lint80_keep_stack", X86_FEATURE_XENPV
 	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
 
 	pushq	6*8(%rdi)		/* regs->ss */
@@ -370,8 +371,9 @@ ENTRY(entry_INT80_compat)
 	pushq	3*8(%rdi)		/* regs->cs */
 	pushq	2*8(%rdi)		/* regs->ip */
 	pushq	1*8(%rdi)		/* regs->orig_ax */
-
 	pushq	(%rdi)			/* pt_regs->di */
+.Lint80_keep_stack:
+
 	pushq	%rsi			/* pt_regs->si */
 	xorl	%esi, %esi		/* nospec   si */
 	pushq	%rdx			/* pt_regs->dx */