All of lore.kernel.org
 help / color / mirror / Atom feed
From: Josh Poimboeuf <jpoimboe@kernel.org>
To: Peter Zijlstra <peterz@infradead.org>
Cc: Guenter Roeck <linux@roeck-us.net>,
	x86@kernel.org, linux-kernel@vger.kernel.org,
	jpoimboe@redhat.com, brgerst@gmail.com, jiangshanlai@gmail.com,
	Andrew.Cooper3@citrix.com, mark.rutland@arm.com,
	Borislav Petkov <bp@suse.de>
Subject: Re: [PATCH 3/6] x86/entry: Use PUSH_AND_CLEAR_REGS for compat
Date: Thu, 19 May 2022 10:35:38 -0700	[thread overview]
Message-ID: <20220519173538.nywtw2h3y7sqfojn@treble> (raw)
In-Reply-To: <20220519171129.enw32izjhxsqc2xm@treble>

On Thu, May 19, 2022 at 10:11:31AM -0700, Josh Poimboeuf wrote:
> On Thu, May 19, 2022 at 07:00:09PM +0200, Peter Zijlstra wrote:
> > On Thu, May 19, 2022 at 09:24:11AM -0700, Guenter Roeck wrote:
> > > On Fri, May 06, 2022 at 02:14:34PM +0200, Peter Zijlstra wrote:
> > > > Since the upper regs don't exist for ia32 code, preserving them
> > > > doesn't hurt and it simplifies the code.
> > > > 
> > > > This doesn't add any attack surface that would not already be
> > > > available through INT80.
> > > > 
> > > > Notably:
> > > > 
> > > >  - 32bit SYSENTER: didn't clear si, dx, cx.
> > > > 
> > > >  - 32bit SYSCALL, INT80: *do* clear si since the C functions don't
> > > >    take a second argument.
> > > > 
> > > >  - 64bit: didn't clear si since the C functions take a second
> > > >    argument; except the error_entry path might have only one argument,
> > > >    so clearing si was missing here.
> > > > 
> > > > 32b SYSENTER should be clearing all those 3 registers, nothing uses them
> > > > and selftests pass.
> > > > 
> > > > Unconditionally clear rsi since it simplifies code.
> > > > 
> > > > Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> > > > Reviewed-by: Borislav Petkov <bp@suse.de>
> > > 
> > > linux-next (next-20220519) crashes due to this patch when booting
> > > q35:EPYC-Rome in qemu.
> > 
> > Could you try backing out each of the hunks one at a time? They're all
> > more or less independent.
> > 
> > My bet with this being a #PF on an AMD machine, it's either the SI clear
> > or the SYSCALL change.
> 
> I think this should fix it:

Actually that one had a horrendous bug :-)

Guenter, can you try this one?

From: Josh Poimboeuf <jpoimboe@kernel.org>
Subject: [PATCH] x86/entry: Fix register corruption in compat syscall

A panic was reported in the init process on AMD:

  Run /sbin/init as init process
  init[1]: segfault at f7fd5ca0 ip 00000000f7f5bbc7 sp 00000000ffa06aa0 error 7 in libc.so[f7f51000+4e000]
  Code: 8a 44 24 10 88 41 ff 8b 44 24 10 83 c4 2c 5b 5e 5f 5d c3 53 83 ec 08 8b 5c 24 10 81 fb 00 f0 ff ff 76 0c e8 ba dc ff ff f7 db <89> 18 83 cb ff 83 c4 08 89 d8 5b c3 e8 81 60 ff ff 05 28 84 07 00
  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
  CPU: 1 PID: 1 Comm: init Tainted: G        W         5.18.0-rc7-next-20220519 #1
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x57/0x7d
   panic+0x10f/0x28d
   do_exit.cold+0x18/0x48
   do_group_exit+0x2e/0xb0
   get_signal+0xb6d/0xb80
   arch_do_signal_or_restart+0x31/0x760
   ? show_opcodes.cold+0x1c/0x21
   ? force_sig_fault+0x49/0x70
   exit_to_user_mode_prepare+0x131/0x1a0
   irqentry_exit_to_user_mode+0x5/0x30
   asm_exc_page_fault+0x27/0x30
  RIP: 0023:0xf7f5bbc7
  Code: 8a 44 24 10 88 41 ff 8b 44 24 10 83 c4 2c 5b 5e 5f 5d c3 53 83 ec 08 8b 5c 24 10 81 fb 00 f0 ff ff 76 0c e8 ba dc ff ff f7 db <89> 18 83 cb ff 83 c4 08 89 d8 5b c3 e8 81 60 ff ff 05 28 84 07 00
  RSP: 002b:00000000ffa06aa0 EFLAGS: 00000217
  RAX: 00000000f7fd5ca0 RBX: 000000000000000c RCX: 0000000000001000
  RDX: 0000000000000001 RSI: 00000000f7fd5b60 RDI: 00000000f7fd5b60
  RBP: 00000000f7fd1c1c R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
  R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
   </TASK>

The task's CX register got corrupted by commit 8c42819b61b8 ("x86/entry:
Use PUSH_AND_CLEAR_REGS for compat"), which overlooked the fact that
compat SYSCALL had the user's CX value stored in BP.

Before that commit, CX was saved from its stashed value in BP:

	pushq   %rbp                    /* pt_regs->cx (stashed in bp) */

But then it got changed to:

	pushq	%rcx			/* pt_regs->cx */

resulting in the wrong value getting saved and later restored back to
the user.  Fix it by pushing the correct value again (BP) for regs->cx.

Fixes: 8c42819b61b8 ("x86/entry: Use PUSH_AND_CLEAR_REGS for compat")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
---
 arch/x86/entry/calling.h         | 8 ++++----
 arch/x86/entry/entry_64_compat.S | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index a97cc78ecb92..29b36e9e4e74 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -63,7 +63,7 @@ For 32-bit we have the following conventions - kernel is built with
  * for assembly code:
  */
 
-.macro PUSH_REGS rdx=%rdx rax=%rax save_ret=0
+.macro PUSH_REGS rdx=%rdx rcx=%rcx rax=%rax save_ret=0
 	.if \save_ret
 	pushq	%rsi		/* pt_regs->si */
 	movq	8(%rsp), %rsi	/* temporarily store the return address in %rsi */
@@ -73,7 +73,7 @@ For 32-bit we have the following conventions - kernel is built with
 	pushq   %rsi		/* pt_regs->si */
 	.endif
 	pushq	\rdx		/* pt_regs->dx */
-	pushq   %rcx		/* pt_regs->cx */
+	pushq   \rcx		/* pt_regs->cx */
 	pushq   \rax		/* pt_regs->ax */
 	pushq   %r8		/* pt_regs->r8 */
 	pushq   %r9		/* pt_regs->r9 */
@@ -115,8 +115,8 @@ For 32-bit we have the following conventions - kernel is built with
 
 .endm
 
-.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax save_ret=0
-	PUSH_REGS rdx=\rdx, rax=\rax, save_ret=\save_ret
+.macro PUSH_AND_CLEAR_REGS rdx=%rdx rcx=%rcx rax=%rax save_ret=0
+	PUSH_REGS rdx=\rdx, rcx=\rcx, rax=\rax, save_ret=\save_ret
 	CLEAR_REGS
 .endm
 
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index ed2be3615b50..f76e674d22c4 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -200,7 +200,7 @@ SYM_INNER_LABEL(entry_SYSCALL_compat_safe_stack, SYM_L_GLOBAL)
 SYM_INNER_LABEL(entry_SYSCALL_compat_after_hwframe, SYM_L_GLOBAL)
 	movl	%eax, %eax		/* discard orig_ax high bits */
 	pushq	%rax			/* pt_regs->orig_ax */
-	PUSH_AND_CLEAR_REGS rax=$-ENOSYS
+	PUSH_AND_CLEAR_REGS rcx=%rbp rax=$-ENOSYS
 	UNWIND_HINT_REGS
 
 	movq	%rsp, %rdi
-- 
2.34.3


  reply	other threads:[~2022-05-19 17:35 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-06 12:14 [PATCH 0/6] x86: Various cleanups and fixes Peter Zijlstra
2022-05-06 12:14 ` [PATCH 1/6] x86/mm: Simplify RESERVE_BRK() Peter Zijlstra
2022-05-06 15:09   ` [tip: x86/asm] " tip-bot2 for Josh Poimboeuf
2022-05-06 12:14 ` [PATCH 2/6] x86/entry: Simplify entry_INT80_compat() Peter Zijlstra
2022-05-06 15:09   ` [tip: x86/asm] " tip-bot2 for Linus Torvalds
2022-05-06 12:14 ` [PATCH 3/6] x86/entry: Use PUSH_AND_CLEAR_REGS for compat Peter Zijlstra
2022-05-06 15:09   ` [tip: x86/asm] " tip-bot2 for Peter Zijlstra
2022-05-07  2:54   ` [PATCH 3/6] " Lai Jiangshan
2022-05-19 16:24   ` Guenter Roeck
2022-05-19 17:00     ` Peter Zijlstra
2022-05-19 17:11       ` Josh Poimboeuf
2022-05-19 17:35         ` Josh Poimboeuf [this message]
2022-05-20  1:11           ` Lai Jiangshan
2022-05-20  2:46             ` Guenter Roeck
2022-05-20 15:55             ` Josh Poimboeuf
2022-05-06 12:14 ` [PATCH 4/6] x86/entry: Remove skip_r11rcx Peter Zijlstra
2022-05-06 15:09   ` [tip: x86/asm] " tip-bot2 for Peter Zijlstra
2022-05-07  2:52   ` [PATCH 4/6] " Lai Jiangshan
2022-05-06 12:14 ` [PATCH 5/6] linkage: Fix issue with missing symbol size Peter Zijlstra
2022-05-06 15:08   ` [tip: x86/asm] " tip-bot2 for Peter Zijlstra
2022-05-06 12:14 ` [PATCH 6/6] objtool: Fix STACK_FRAME_NON_STANDARD reloc type Peter Zijlstra
2022-05-06 15:08   ` [tip: x86/asm] " tip-bot2 for Peter Zijlstra
2022-05-06 16:05   ` [PATCH 6/6] " Josh Poimboeuf
2022-05-06 20:26   ` [tip: x86/asm] " tip-bot2 for Peter Zijlstra
2022-05-19 18:31 [PATCH 3/6] x86/entry: Use PUSH_AND_CLEAR_REGS for compat Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220519173538.nywtw2h3y7sqfojn@treble \
    --to=jpoimboe@kernel.org \
    --cc=Andrew.Cooper3@citrix.com \
    --cc=bp@suse.de \
    --cc=brgerst@gmail.com \
    --cc=jiangshanlai@gmail.com \
    --cc=jpoimboe@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@roeck-us.net \
    --cc=mark.rutland@arm.com \
    --cc=peterz@infradead.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.