linux-kernel - Re: Stable linux-5.10.x regression triggered by MDS mitigation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 25 Jun 2024 11:01:50 -0700
From: Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
To: Jari Ruusu <jariruusu@...tonmail.com>
Cc: Dave Hansen <dave.hansen@...ux.intel.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: Stable linux-5.10.x regression triggered by MDS mitigation

On Tue, Jun 25, 2024 at 01:49:17PM +0000, Jari Ruusu wrote:
> On Monday, June 24th, 2024 at 20:09, Pawan Gupta <pawan.kumar.gupta@...ux.intel.com> wrote:
> > Below patch (for v6.10-rc5) should fix this. I didn't send this patch
> > earlier because I havn't got a chance to make sure if it will work for
> > other cases like modify_ldt().
> 
> Thank you for fixing this regression.
> 
> I tested your patch on 32-bit linux-5.10.220 inside VM, and now
> dosemu seems to work OK.
> 
> I do have a related question:
> In SYSENTER code path (that is not used by virtual-8086 mode),
> there is CLEAR_CPU_BUFFERS just before STI and SYSEXIT, but that
> CLEAR_CPU_BUFFERS happens after flags are restored with POPFL.
> VERW opcode inside that CLEAR_CPU_BUFFERS modifies ZF flag.

Thanks for pointing this out, CLEAR_CPU_BUFFERS should happen before POPFL.
Below patch moves it before POPFL and also adds a safer version that
switches to KERNEL_DS before executing VERW. This should ensure VERW works
in all cases:

---
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index c963abc17a96..2680be38e5cb 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -253,6 +253,17 @@
 .Lend_\@:
 .endm
 
+/* Make sure ds has a safe value so that VERW does not #GP */
+.macro CLEAR_CPU_BUFFERS_SAFE
+	ALTERNATIVE "jmp .Lskip_verw\@", "", X86_FEATURE_CLEAR_CPU_BUF
+	pushl	%ds
+	pushl	$(__KERNEL_DS)
+	popl	%ds
+	verw	_ASM_RIP(mds_verw_sel)
+	popl	%ds
+.Lskip_verw\@:
+.endm
+
 .macro RESTORE_INT_REGS
 	popl	%ebx
 	popl	%ecx
@@ -878,6 +889,7 @@ SYM_FUNC_START(entry_SYSENTER_32)
 
 	/* Now ready to switch the cr3 */
 	SWITCH_TO_USER_CR3 scratch_reg=%eax
+	CLEAR_CPU_BUFFERS_SAFE
 
 	/*
 	 * Restore all flags except IF. (We restore IF separately because
@@ -888,7 +900,6 @@ SYM_FUNC_START(entry_SYSENTER_32)
 	BUG_IF_WRONG_CR3 no_user_check=1
 	popfl
 	popl	%eax
-	CLEAR_CPU_BUFFERS
 
 	/*
 	 * Return back to the vDSO, which will pop ecx and edx.