All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
@ 2018-07-22 18:05 Andy Lutomirski
  2018-07-23  7:25 ` Greg KH
                   ` (2 more replies)
  0 siblings, 3 replies; 13+ messages in thread
From: Andy Lutomirski @ 2018-07-22 18:05 UTC (permalink / raw)
  To: x86, LKML
  Cc: Borislav Petkov, Linus Torvalds, Dave Hansen, Greg KH,
	Andy Lutomirski, Brian Gerst, Dominik Brodowski, Ingo Molnar,
	H. Peter Anvin, Thomas Gleixner, Boris Ostrovsky, Juergen Gross,
	xen-devel, stable

error_entry and error_exit communicate the user vs kernel status of
the frame using %ebx.  This is unnecessary -- the information is in
regs->cs.  Just use regs->cs.

This makes error_entry simpler and makes error_exit more robust.

It also fixes a nasty bug.  Before all the Spectre nonsense, The
xen_failsafe_callback entry point returned like this:

        ALLOC_PT_GPREGS_ON_STACK
        SAVE_C_REGS
        SAVE_EXTRA_REGS
        ENCODE_FRAME_POINTER
        jmp     error_exit

And it did not go through error_entry.  This was bogus: RBX
contained garbage, and error_exit expected a flag in RBX.
Fortunately, it generally contained *nonzero* garbage, so the
correct code path was used.  As part of the Spectre fixes, code was
added to clear RBX to mitigate certain speculation attacks.  Now,
depending on kernel configuration, RBX got zeroed and, when running
some Wine workloads, the kernel crashes.  This was introduced by:

    commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
    exceptions/interrupts, to reduce speculation attack surface")

With this patch applied, RBX is no longer needed as a flag, and the
problem goes away.

I suspect that malicious userspace could use this bug to crash the
kernel even without the offending patch applied, though.

[Historical note: I wrote this patch as a cleanup before I was aware
 of the bug it fixed.]

[Note to stable maintainers: this should probably get applied to all
 kernels.  If you're nervous about that, a more conservative fix to
 add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
 also fix the problem.]

Cc: Brian Gerst <brgerst@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: xen-devel@lists.xenproject.org
Cc: x86@kernel.org
Cc: stable@vger.kernel.org
Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---

I could also submit the conservative fix tagged for -stable and respin
this on top of it.  Ingo, Greg, what do you prefer?

 arch/x86/entry/entry_64.S | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 73a522d53b53..8ae7ffda8f98 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -981,7 +981,7 @@ ENTRY(\sym)
 
 	call	\do_sym
 
-	jmp	error_exit			/* %ebx: no swapgs flag */
+	jmp	error_exit
 	.endif
 END(\sym)
 .endm
@@ -1222,7 +1222,6 @@ END(paranoid_exit)
 
 /*
  * Save all registers in pt_regs, and switch GS if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
 	UNWIND_HINT_FUNC
@@ -1269,7 +1268,6 @@ ENTRY(error_entry)
 	 * for these here too.
 	 */
 .Lerror_kernelspace:
-	incl	%ebx
 	leaq	native_irq_return_iret(%rip), %rcx
 	cmpq	%rcx, RIP+8(%rsp)
 	je	.Lerror_bad_iret
@@ -1303,28 +1301,20 @@ ENTRY(error_entry)
 
 	/*
 	 * Pretend that the exception came from user mode: set up pt_regs
-	 * as if we faulted immediately after IRET and clear EBX so that
-	 * error_exit knows that we will be returning to user mode.
+	 * as if we faulted immediately after IRET.
 	 */
 	mov	%rsp, %rdi
 	call	fixup_bad_iret
 	mov	%rax, %rsp
-	decl	%ebx
 	jmp	.Lerror_entry_from_usermode_after_swapgs
 END(error_entry)
 
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- *   1: already in kernel mode, don't need SWAPGS
- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
 ENTRY(error_exit)
 	UNWIND_HINT_REGS
 	DISABLE_INTERRUPTS(CLBR_ANY)
 	TRACE_IRQS_OFF
-	testl	%ebx, %ebx
-	jnz	retint_kernel
+	testb	$3, CS(%rsp)
+	jz	retint_kernel
 	jmp	retint_user
 END(error_exit)
 
-- 
2.17.1


^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-07-22 18:05 [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Andy Lutomirski
@ 2018-07-23  7:25 ` Greg KH
  2018-07-24  2:31   ` Andy Lutomirski
  2018-07-24  2:31   ` Andy Lutomirski
  2018-07-23  7:25 ` Greg KH
  2018-07-24 15:03 ` [tip:x86/urgent] " tip-bot for Andy Lutomirski
  2 siblings, 2 replies; 13+ messages in thread
From: Greg KH @ 2018-07-23  7:25 UTC (permalink / raw)
  To: Andy Lutomirski
  Cc: x86, LKML, Borislav Petkov, Linus Torvalds, Dave Hansen,
	Brian Gerst, Dominik Brodowski, Ingo Molnar, H. Peter Anvin,
	Thomas Gleixner, Boris Ostrovsky, Juergen Gross, xen-devel,
	stable

On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote:
> error_entry and error_exit communicate the user vs kernel status of
> the frame using %ebx.  This is unnecessary -- the information is in
> regs->cs.  Just use regs->cs.
> 
> This makes error_entry simpler and makes error_exit more robust.
> 
> It also fixes a nasty bug.  Before all the Spectre nonsense, The
> xen_failsafe_callback entry point returned like this:
> 
>         ALLOC_PT_GPREGS_ON_STACK
>         SAVE_C_REGS
>         SAVE_EXTRA_REGS
>         ENCODE_FRAME_POINTER
>         jmp     error_exit
> 
> And it did not go through error_entry.  This was bogus: RBX
> contained garbage, and error_exit expected a flag in RBX.
> Fortunately, it generally contained *nonzero* garbage, so the
> correct code path was used.  As part of the Spectre fixes, code was
> added to clear RBX to mitigate certain speculation attacks.  Now,
> depending on kernel configuration, RBX got zeroed and, when running
> some Wine workloads, the kernel crashes.  This was introduced by:
> 
>     commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>     exceptions/interrupts, to reduce speculation attack surface")
> 
> With this patch applied, RBX is no longer needed as a flag, and the
> problem goes away.
> 
> I suspect that malicious userspace could use this bug to crash the
> kernel even without the offending patch applied, though.
> 
> [Historical note: I wrote this patch as a cleanup before I was aware
>  of the bug it fixed.]
> 
> [Note to stable maintainers: this should probably get applied to all
>  kernels.  If you're nervous about that, a more conservative fix to
>  add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
>  also fix the problem.]
> 
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: xen-devel@lists.xenproject.org
> Cc: x86@kernel.org
> Cc: stable@vger.kernel.org
> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> ---
> 
> I could also submit the conservative fix tagged for -stable and respin
> this on top of it.  Ingo, Greg, what do you prefer?

I don't care, this patch looks good to me to take as-is for the stable
trees.  If you trust it in Linus's tree, it should be fine for others :)

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-07-22 18:05 [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Andy Lutomirski
  2018-07-23  7:25 ` Greg KH
@ 2018-07-23  7:25 ` Greg KH
  2018-07-24 15:03 ` [tip:x86/urgent] " tip-bot for Andy Lutomirski
  2 siblings, 0 replies; 13+ messages in thread
From: Greg KH @ 2018-07-23  7:25 UTC (permalink / raw)
  To: Andy Lutomirski
  Cc: Juergen Gross, Dave Hansen, Brian Gerst, x86, LKML,
	Dominik Brodowski, Ingo Molnar, Borislav Petkov, stable,
	H. Peter Anvin, xen-devel, Thomas Gleixner, Linus Torvalds,
	Boris Ostrovsky

On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote:
> error_entry and error_exit communicate the user vs kernel status of
> the frame using %ebx.  This is unnecessary -- the information is in
> regs->cs.  Just use regs->cs.
> 
> This makes error_entry simpler and makes error_exit more robust.
> 
> It also fixes a nasty bug.  Before all the Spectre nonsense, The
> xen_failsafe_callback entry point returned like this:
> 
>         ALLOC_PT_GPREGS_ON_STACK
>         SAVE_C_REGS
>         SAVE_EXTRA_REGS
>         ENCODE_FRAME_POINTER
>         jmp     error_exit
> 
> And it did not go through error_entry.  This was bogus: RBX
> contained garbage, and error_exit expected a flag in RBX.
> Fortunately, it generally contained *nonzero* garbage, so the
> correct code path was used.  As part of the Spectre fixes, code was
> added to clear RBX to mitigate certain speculation attacks.  Now,
> depending on kernel configuration, RBX got zeroed and, when running
> some Wine workloads, the kernel crashes.  This was introduced by:
> 
>     commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>     exceptions/interrupts, to reduce speculation attack surface")
> 
> With this patch applied, RBX is no longer needed as a flag, and the
> problem goes away.
> 
> I suspect that malicious userspace could use this bug to crash the
> kernel even without the offending patch applied, though.
> 
> [Historical note: I wrote this patch as a cleanup before I was aware
>  of the bug it fixed.]
> 
> [Note to stable maintainers: this should probably get applied to all
>  kernels.  If you're nervous about that, a more conservative fix to
>  add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
>  also fix the problem.]
> 
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: xen-devel@lists.xenproject.org
> Cc: x86@kernel.org
> Cc: stable@vger.kernel.org
> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> ---
> 
> I could also submit the conservative fix tagged for -stable and respin
> this on top of it.  Ingo, Greg, what do you prefer?

I don't care, this patch looks good to me to take as-is for the stable
trees.  If you trust it in Linus's tree, it should be fine for others :)

thanks,

greg k-h

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-07-23  7:25 ` Greg KH
  2018-07-24  2:31   ` Andy Lutomirski
@ 2018-07-24  2:31   ` Andy Lutomirski
  1 sibling, 0 replies; 13+ messages in thread
From: Andy Lutomirski @ 2018-07-24  2:31 UTC (permalink / raw)
  To: Greg KH
  Cc: Andy Lutomirski, X86 ML, LKML, Borislav Petkov, Linus Torvalds,
	Dave Hansen, Brian Gerst, Dominik Brodowski, Ingo Molnar,
	H. Peter Anvin, Thomas Gleixner, Boris Ostrovsky, Juergen Gross,
	xen-devel, stable

On Mon, Jul 23, 2018 at 12:25 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote:
>> error_entry and error_exit communicate the user vs kernel status of
>> the frame using %ebx.  This is unnecessary -- the information is in
>> regs->cs.  Just use regs->cs.
>>
>> This makes error_entry simpler and makes error_exit more robust.
>>
>> It also fixes a nasty bug.  Before all the Spectre nonsense, The
>> xen_failsafe_callback entry point returned like this:
>>
>>         ALLOC_PT_GPREGS_ON_STACK
>>         SAVE_C_REGS
>>         SAVE_EXTRA_REGS
>>         ENCODE_FRAME_POINTER
>>         jmp     error_exit
>>
>> And it did not go through error_entry.  This was bogus: RBX
>> contained garbage, and error_exit expected a flag in RBX.
>> Fortunately, it generally contained *nonzero* garbage, so the
>> correct code path was used.  As part of the Spectre fixes, code was
>> added to clear RBX to mitigate certain speculation attacks.  Now,
>> depending on kernel configuration, RBX got zeroed and, when running
>> some Wine workloads, the kernel crashes.  This was introduced by:
>>
>>     commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>>     exceptions/interrupts, to reduce speculation attack surface")
>>
>> With this patch applied, RBX is no longer needed as a flag, and the
>> problem goes away.
>>
>> I suspect that malicious userspace could use this bug to crash the
>> kernel even without the offending patch applied, though.
>>
>> [Historical note: I wrote this patch as a cleanup before I was aware
>>  of the bug it fixed.]
>>
>> [Note to stable maintainers: this should probably get applied to all
>>  kernels.  If you're nervous about that, a more conservative fix to
>>  add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
>>  also fix the problem.]
>>
>> Cc: Brian Gerst <brgerst@gmail.com>
>> Cc: Borislav Petkov <bp@alien8.de>
>> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: "H. Peter Anvin" <hpa@zytor.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>> Cc: Juergen Gross <jgross@suse.com>
>> Cc: xen-devel@lists.xenproject.org
>> Cc: x86@kernel.org
>> Cc: stable@vger.kernel.org
>> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
>> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
>> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>> ---
>>
>> I could also submit the conservative fix tagged for -stable and respin
>> this on top of it.  Ingo, Greg, what do you prefer?
>
> I don't care, this patch looks good to me to take as-is for the stable
> trees.  If you trust it in Linus's tree, it should be fine for others :)
>

My concern is more that something may work differently in older
kernels and there might be some subtle issue.  I'd be surprised, but
still.

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-07-23  7:25 ` Greg KH
@ 2018-07-24  2:31   ` Andy Lutomirski
  2018-07-24  2:31   ` Andy Lutomirski
  1 sibling, 0 replies; 13+ messages in thread
From: Andy Lutomirski @ 2018-07-24  2:31 UTC (permalink / raw)
  To: Greg KH
  Cc: Juergen Gross, X86 ML, Brian Gerst, Dave Hansen, LKML,
	Dominik Brodowski, Ingo Molnar, Borislav Petkov, stable,
	Andy Lutomirski, H. Peter Anvin, xen-devel, Thomas Gleixner,
	Linus Torvalds, Boris Ostrovsky

On Mon, Jul 23, 2018 at 12:25 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote:
>> error_entry and error_exit communicate the user vs kernel status of
>> the frame using %ebx.  This is unnecessary -- the information is in
>> regs->cs.  Just use regs->cs.
>>
>> This makes error_entry simpler and makes error_exit more robust.
>>
>> It also fixes a nasty bug.  Before all the Spectre nonsense, The
>> xen_failsafe_callback entry point returned like this:
>>
>>         ALLOC_PT_GPREGS_ON_STACK
>>         SAVE_C_REGS
>>         SAVE_EXTRA_REGS
>>         ENCODE_FRAME_POINTER
>>         jmp     error_exit
>>
>> And it did not go through error_entry.  This was bogus: RBX
>> contained garbage, and error_exit expected a flag in RBX.
>> Fortunately, it generally contained *nonzero* garbage, so the
>> correct code path was used.  As part of the Spectre fixes, code was
>> added to clear RBX to mitigate certain speculation attacks.  Now,
>> depending on kernel configuration, RBX got zeroed and, when running
>> some Wine workloads, the kernel crashes.  This was introduced by:
>>
>>     commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>>     exceptions/interrupts, to reduce speculation attack surface")
>>
>> With this patch applied, RBX is no longer needed as a flag, and the
>> problem goes away.
>>
>> I suspect that malicious userspace could use this bug to crash the
>> kernel even without the offending patch applied, though.
>>
>> [Historical note: I wrote this patch as a cleanup before I was aware
>>  of the bug it fixed.]
>>
>> [Note to stable maintainers: this should probably get applied to all
>>  kernels.  If you're nervous about that, a more conservative fix to
>>  add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
>>  also fix the problem.]
>>
>> Cc: Brian Gerst <brgerst@gmail.com>
>> Cc: Borislav Petkov <bp@alien8.de>
>> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: "H. Peter Anvin" <hpa@zytor.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>> Cc: Juergen Gross <jgross@suse.com>
>> Cc: xen-devel@lists.xenproject.org
>> Cc: x86@kernel.org
>> Cc: stable@vger.kernel.org
>> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
>> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
>> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>> ---
>>
>> I could also submit the conservative fix tagged for -stable and respin
>> this on top of it.  Ingo, Greg, what do you prefer?
>
> I don't care, this patch looks good to me to take as-is for the stable
> trees.  If you trust it in Linus's tree, it should be fine for others :)
>

My concern is more that something may work differently in older
kernels and there might be some subtle issue.  I'd be surprised, but
still.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

^ permalink raw reply	[flat|nested] 13+ messages in thread

* [tip:x86/urgent] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-07-22 18:05 [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Andy Lutomirski
  2018-07-23  7:25 ` Greg KH
  2018-07-23  7:25 ` Greg KH
@ 2018-07-24 15:03 ` tip-bot for Andy Lutomirski
  2 siblings, 0 replies; 13+ messages in thread
From: tip-bot for Andy Lutomirski @ 2018-07-24 15:03 UTC (permalink / raw)
  To: linux-tip-commits
  Cc: gregkh, jgross, mingo, luto, tglx, linux, torvalds, jpoimboe,
	boris.ostrovsky, peterz, hpa, bp, linux-kernel, dave.hansen,
	brgerst, dvlasenk, m.v.b

Commit-ID:  b3681dd548d06deb2e1573890829dff4b15abf46
Gitweb:     https://git.kernel.org/tip/b3681dd548d06deb2e1573890829dff4b15abf46
Author:     Andy Lutomirski <luto@kernel.org>
AuthorDate: Sun, 22 Jul 2018 11:05:09 -0700
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 24 Jul 2018 10:07:36 +0200

x86/entry/64: Remove %ebx handling from error_entry/exit

error_entry and error_exit communicate the user vs. kernel status of
the frame using %ebx.  This is unnecessary -- the information is in
regs->cs.  Just use regs->cs.

This makes error_entry simpler and makes error_exit more robust.

It also fixes a nasty bug.  Before all the Spectre nonsense, the
xen_failsafe_callback entry point returned like this:

        ALLOC_PT_GPREGS_ON_STACK
        SAVE_C_REGS
        SAVE_EXTRA_REGS
        ENCODE_FRAME_POINTER
        jmp     error_exit

And it did not go through error_entry.  This was bogus: RBX
contained garbage, and error_exit expected a flag in RBX.

Fortunately, it generally contained *nonzero* garbage, so the
correct code path was used.  As part of the Spectre fixes, code was
added to clear RBX to mitigate certain speculation attacks.  Now,
depending on kernel configuration, RBX got zeroed and, when running
some Wine workloads, the kernel crashes.  This was introduced by:

    commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")

With this patch applied, RBX is no longer needed as a flag, and the
problem goes away.

I suspect that malicious userspace could use this bug to crash the
kernel even without the offending patch applied, though.

[ Historical note: I wrote this patch as a cleanup before I was aware
  of the bug it fixed. ]

[ Note to stable maintainers: this should probably get applied to all
  kernels.  If you're nervous about that, a more conservative fix to
  add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
  also fix the problem. ]

Reported-and-tested-by: M. Vefa Bicakci <m.v.b@runbox.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
Link: http://lkml.kernel.org/r/b5010a090d3586b2d6e06c7ad3ec5542d1241c45.1532282627.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/entry/entry_64.S | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 73a522d53b53..8ae7ffda8f98 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -981,7 +981,7 @@ ENTRY(\sym)
 
 	call	\do_sym
 
-	jmp	error_exit			/* %ebx: no swapgs flag */
+	jmp	error_exit
 	.endif
 END(\sym)
 .endm
@@ -1222,7 +1222,6 @@ END(paranoid_exit)
 
 /*
  * Save all registers in pt_regs, and switch GS if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
 	UNWIND_HINT_FUNC
@@ -1269,7 +1268,6 @@ ENTRY(error_entry)
 	 * for these here too.
 	 */
 .Lerror_kernelspace:
-	incl	%ebx
 	leaq	native_irq_return_iret(%rip), %rcx
 	cmpq	%rcx, RIP+8(%rsp)
 	je	.Lerror_bad_iret
@@ -1303,28 +1301,20 @@ ENTRY(error_entry)
 
 	/*
 	 * Pretend that the exception came from user mode: set up pt_regs
-	 * as if we faulted immediately after IRET and clear EBX so that
-	 * error_exit knows that we will be returning to user mode.
+	 * as if we faulted immediately after IRET.
 	 */
 	mov	%rsp, %rdi
 	call	fixup_bad_iret
 	mov	%rax, %rsp
-	decl	%ebx
 	jmp	.Lerror_entry_from_usermode_after_swapgs
 END(error_entry)
 
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- *   1: already in kernel mode, don't need SWAPGS
- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
 ENTRY(error_exit)
 	UNWIND_HINT_REGS
 	DISABLE_INTERRUPTS(CLBR_ANY)
 	TRACE_IRQS_OFF
-	testl	%ebx, %ebx
-	jnz	retint_kernel
+	testb	$3, CS(%rsp)
+	jz	retint_kernel
 	jmp	retint_user
 END(error_exit)
 

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-08-16 15:19       ` Greg KH
@ 2018-08-16 15:35         ` Andy Lutomirski
  0 siblings, 0 replies; 13+ messages in thread
From: Andy Lutomirski @ 2018-08-16 15:35 UTC (permalink / raw)
  To: Greg KH
  Cc: Juergen Gross, H. Peter Anvin, Boris Ostrovsky, Brian Gerst,
	X86 ML, stable, Durand Wesolowski, Jimmy, Borislav Petkov,
	Dominik Brodowski, Andy Lutomirski, Sarah Newman, xen-devel,
	Thomas Gleixner, David Woodhouse, Ingo Molnar

On Thu, Aug 16, 2018 at 8:19 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> On Fri, Aug 10, 2018 at 12:23:45AM -0700, Sarah Newman wrote:
>> On 08/09/2018 05:41 AM, David Woodhouse wrote:
>> > On Wed, 2018-08-08 at 10:35 -0700, Sarah Newman wrote:
>> >> commit b3681dd548d06deb2e1573890829dff4b15abf46 upstream.
>> >>
>> >> This version applies to v4.9.
>> >
>> > I think you can kill the 'xorl %ebx,%ebx' from error_entry too but yes,
>> > this does want to go to 4.9 and earlier because the 'Fixes:' tag is a
>> > bit of a lie — the problem existed before that, at least in theory.
>>
>> The commit 2140a9942 "x86/entry/64: Relax pvops stub clobber
>> specifications" was what removed the "movl %ebx, %eax" line later on
>> originally, but it was the commit 3ac6d8c787b8 that removed the
>> 'xorl %ebx,%ebx'. So these weren't matched.
>>
>> I don't know if it's a concern, but if someone had gone to the effort of
>> backporting the original commit 3ac6d8c787b83, adding the removal of
>> 'xorl %ebx,%ebx' to this patch would create merge conflicts.
>> For that reason and given the line is harmless, should it be left in?
>
> I need some kind of agreement here for me to know what to do with this
> patch...  {hint}
>

I would remove the xorl.

If there's an actual candidate patch, I'd be happy to read it.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-08-10  7:23     ` [Xen-devel] " Sarah Newman
  2018-08-16 15:19       ` Greg KH
@ 2018-08-16 15:19       ` Greg KH
  1 sibling, 0 replies; 13+ messages in thread
From: Greg KH @ 2018-08-16 15:19 UTC (permalink / raw)
  To: Sarah Newman
  Cc: Juergen Gross, Boris Ostrovsky, Brian Gerst, x86, stable,
	Durand Wesolowski, Jimmy, Borislav Petkov, Dominik Brodowski,
	Andy Lutomirski, H. Peter Anvin, xen-devel, Thomas Gleixner,
	David Woodhouse, Ingo Molnar

On Fri, Aug 10, 2018 at 12:23:45AM -0700, Sarah Newman wrote:
> On 08/09/2018 05:41 AM, David Woodhouse wrote:
> > On Wed, 2018-08-08 at 10:35 -0700, Sarah Newman wrote:
> >> commit b3681dd548d06deb2e1573890829dff4b15abf46 upstream.
> >>
> >> This version applies to v4.9.
> > 
> > I think you can kill the 'xorl %ebx,%ebx' from error_entry too but yes,
> > this does want to go to 4.9 and earlier because the 'Fixes:' tag is a
> > bit of a lie — the problem existed before that, at least in theory.
> 
> The commit 2140a9942 "x86/entry/64: Relax pvops stub clobber
> specifications" was what removed the "movl %ebx, %eax" line later on
> originally, but it was the commit 3ac6d8c787b8 that removed the
> 'xorl %ebx,%ebx'. So these weren't matched.
> 
> I don't know if it's a concern, but if someone had gone to the effort of
> backporting the original commit 3ac6d8c787b83, adding the removal of
> 'xorl %ebx,%ebx' to this patch would create merge conflicts.
> For that reason and given the line is harmless, should it be left in?

I need some kind of agreement here for me to know what to do with this
patch...  {hint}

thanks,

greg k-h

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-08-09 12:41   ` [Xen-devel] " David Woodhouse
@ 2018-08-10  7:23     ` Sarah Newman
  2018-08-10  7:23     ` [Xen-devel] " Sarah Newman
  1 sibling, 0 replies; 13+ messages in thread
From: Sarah Newman @ 2018-08-10  7:23 UTC (permalink / raw)
  To: David Woodhouse, stable, Durand Wesolowski, Jimmy
  Cc: Juergen Gross, Brian Gerst, x86, Dominik Brodowski, Ingo Molnar,
	Borislav Petkov, Andy Lutomirski, H. Peter Anvin, xen-devel,
	Thomas Gleixner, Boris Ostrovsky

On 08/09/2018 05:41 AM, David Woodhouse wrote:
> On Wed, 2018-08-08 at 10:35 -0700, Sarah Newman wrote:
>> commit b3681dd548d06deb2e1573890829dff4b15abf46 upstream.
>>
>> This version applies to v4.9.
> 
> I think you can kill the 'xorl %ebx,%ebx' from error_entry too but yes,
> this does want to go to 4.9 and earlier because the 'Fixes:' tag is a
> bit of a lie — the problem existed before that, at least in theory.

The commit 2140a9942 "x86/entry/64: Relax pvops stub clobber
specifications" was what removed the "movl %ebx, %eax" line later on
originally, but it was the commit 3ac6d8c787b8 that removed the
'xorl %ebx,%ebx'. So these weren't matched.

I don't know if it's a concern, but if someone had gone to the effort of
backporting the original commit 3ac6d8c787b83, adding the removal of
'xorl %ebx,%ebx' to this patch would create merge conflicts.
For that reason and given the line is harmless, should it be left in?

> 
>> From Andy Lutomirski, original author:
>>
>> error_entry and error_exit communicate the user vs kernel status of
>> the frame using %ebx.  This is unnecessary -- the information is in
>> regs->cs.  Just use regs->cs.
>>
>> This makes error_entry simpler and makes error_exit more robust.
>>
>> It also fixes a nasty bug.  Before all the Spectre nonsense, The
>> xen_failsafe_callback entry point returned like this:
>>
>>         ALLOC_PT_GPREGS_ON_STACK
>>         SAVE_C_REGS
>>         SAVE_EXTRA_REGS
>>         ENCODE_FRAME_POINTER
>>         jmp     error_exit
>>
>> And it did not go through error_entry.  This was bogus: RBX
>> contained garbage, and error_exit expected a flag in RBX.
>> Fortunately, it generally contained *nonzero* garbage, so the
>> correct code path was used.  As part of the Spectre fixes, code was
>> added to clear RBX to mitigate certain speculation attacks.  Now,
>> depending on kernel configuration, RBX got zeroed and, when running
>> some Wine workloads, the kernel crashes.  This was introduced by:
>>
>>     commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>>     exceptions/interrupts, to reduce speculation attack surface")
>>
>> With this patch applied, RBX is no longer needed as a flag, and the
>> problem goes away.
>>
>> I suspect that malicious userspace could use this bug to crash the
>> kernel even without the offending patch applied, though.
>>
>> [Historical note: I wrote this patch as a cleanup before I was aware
>>  of the bug it fixed.]
>>
>> [Note to stable maintainers: this should probably get applied to all
>>  kernels.]
>>
>> Cc: Brian Gerst <brgerst@gmail.com>
>> Cc: Borislav Petkov <bp@alien8.de>
>> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: "H. Peter Anvin" <hpa@zytor.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>> Cc: Juergen Gross <jgross@suse.com>
>> Cc: xen-devel@lists.xenproject.org
>> Cc: x86@kernel.org
>> Cc: stable@vger.kernel.org
>> Cc: Andy Lutomirski <luto@kernel.org>
>> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>> exceptions/interrupts, to reduce speculation attack surface")
>> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
>> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>> Signed-off-by: Sarah Newman <srn@prgmr.com>
>> ---
>>  arch/x86/entry/entry_64.S | 19 ++++---------------
>>  1 file changed, 4 insertions(+), 15 deletions(-)
>>
>> diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
>> index d58d8dc..0dab47a 100644
>> --- a/arch/x86/entry/entry_64.S
>> +++ b/arch/x86/entry/entry_64.S
>> @@ -774,7 +774,7 @@ ENTRY(\sym)
>>  
>>  	call	\do_sym
>>  
>> -	jmp	error_exit			/* %ebx: no
>> swapgs flag */
>> +	jmp	error_exit
>>  	.endif
>>  END(\sym)
>>  .endm
>> @@ -1043,7 +1043,6 @@ END(paranoid_exit)
>>  
>>  /*
>>   * Save all registers in pt_regs, and switch gs if needed.
>> - * Return: EBX=0: came from user mode; EBX=1: otherwise
>>   */
>>  ENTRY(error_entry)
>>  	cld
>> @@ -1087,7 +1086,6 @@ ENTRY(error_entry)
>>  	 * for these here too.
>>  	 */
>>  .Lerror_kernelspace:
>> -	incl	%ebx
>>  	leaq	native_irq_return_iret(%rip), %rcx
>>  	cmpq	%rcx, RIP+8(%rsp)
>>  	je	.Lerror_bad_iret
>> @@ -1119,28 +1117,19 @@ ENTRY(error_entry)
>>  
>>  	/*
>>  	 * Pretend that the exception came from user mode: set up
>> pt_regs
>> -	 * as if we faulted immediately after IRET and clear EBX so
>> that
>> -	 * error_exit knows that we will be returning to user mode.
>> +	 * as if we faulted immediately after IRET.
>>  	 */
>>  	mov	%rsp, %rdi
>>  	call	fixup_bad_iret
>>  	mov	%rax, %rsp
>> -	decl	%ebx
>>  	jmp	.Lerror_entry_from_usermode_after_swapgs
>>  END(error_entry)
>>  
>> -
>> -/*
>> - * On entry, EBX is a "return to kernel mode" flag:
>> - *   1: already in kernel mode, don't need SWAPGS
>> - *   0: user gsbase is loaded, we need SWAPGS and standard
>> preparation for return to usermode
>> - */
>>  ENTRY(error_exit)
>> -	movl	%ebx, %eax
>>  	DISABLE_INTERRUPTS(CLBR_NONE)
>>  	TRACE_IRQS_OFF
>> -	testl	%eax, %eax
>> -	jnz	retint_kernel
>> +	testb	$3, CS(%rsp)
>> +	jz	retint_kernel
>>  	jmp	retint_user
>>  END(error_exit)
>>  
>>
>>
>> _______________________________________________
>> Xen-devel mailing list
>> Xen-devel@lists.xenproject.org
>> https://lists.xenproject.org/mailman/listinfo/xen-devel


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-08-08 17:35   ` Sarah Newman
  (?)
@ 2018-08-09 12:41   ` David Woodhouse
  -1 siblings, 0 replies; 13+ messages in thread
From: David Woodhouse @ 2018-08-09 12:41 UTC (permalink / raw)
  To: Sarah Newman, stable, Durand Wesolowski, Jimmy
  Cc: Juergen Gross, Brian Gerst, x86, Dominik Brodowski, Ingo Molnar,
	Borislav Petkov, Andy Lutomirski, H. Peter Anvin, xen-devel,
	Thomas Gleixner, Boris Ostrovsky


[-- Attachment #1.1: Type: text/plain, Size: 4713 bytes --]

On Wed, 2018-08-08 at 10:35 -0700, Sarah Newman wrote:
> commit b3681dd548d06deb2e1573890829dff4b15abf46 upstream.
> 
> This version applies to v4.9.

I think you can kill the 'xorl %ebx,%ebx' from error_entry too but yes,
this does want to go to 4.9 and earlier because the 'Fixes:' tag is a
bit of a lie — the problem existed before that, at least in theory.

> From Andy Lutomirski, original author:
> 
> error_entry and error_exit communicate the user vs kernel status of
> the frame using %ebx.  This is unnecessary -- the information is in
> regs->cs.  Just use regs->cs.
> 
> This makes error_entry simpler and makes error_exit more robust.
> 
> It also fixes a nasty bug.  Before all the Spectre nonsense, The
> xen_failsafe_callback entry point returned like this:
> 
>         ALLOC_PT_GPREGS_ON_STACK
>         SAVE_C_REGS
>         SAVE_EXTRA_REGS
>         ENCODE_FRAME_POINTER
>         jmp     error_exit
> 
> And it did not go through error_entry.  This was bogus: RBX
> contained garbage, and error_exit expected a flag in RBX.
> Fortunately, it generally contained *nonzero* garbage, so the
> correct code path was used.  As part of the Spectre fixes, code was
> added to clear RBX to mitigate certain speculation attacks.  Now,
> depending on kernel configuration, RBX got zeroed and, when running
> some Wine workloads, the kernel crashes.  This was introduced by:
> 
>     commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
>     exceptions/interrupts, to reduce speculation attack surface")
> 
> With this patch applied, RBX is no longer needed as a flag, and the
> problem goes away.
> 
> I suspect that malicious userspace could use this bug to crash the
> kernel even without the offending patch applied, though.
> 
> [Historical note: I wrote this patch as a cleanup before I was aware
>  of the bug it fixed.]
> 
> [Note to stable maintainers: this should probably get applied to all
>  kernels.]
> 
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Dominik Brodowski <linux@dominikbrodowski.net>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: xen-devel@lists.xenproject.org
> Cc: x86@kernel.org
> Cc: stable@vger.kernel.org
> Cc: Andy Lutomirski <luto@kernel.org>
> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for
> exceptions/interrupts, to reduce speculation attack surface")
> Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> Signed-off-by: Sarah Newman <srn@prgmr.com>
> ---
>  arch/x86/entry/entry_64.S | 19 ++++---------------
>  1 file changed, 4 insertions(+), 15 deletions(-)
> 
> diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
> index d58d8dc..0dab47a 100644
> --- a/arch/x86/entry/entry_64.S
> +++ b/arch/x86/entry/entry_64.S
> @@ -774,7 +774,7 @@ ENTRY(\sym)
>  
>  	call	\do_sym
>  
> -	jmp	error_exit			/* %ebx: no
> swapgs flag */
> +	jmp	error_exit
>  	.endif
>  END(\sym)
>  .endm
> @@ -1043,7 +1043,6 @@ END(paranoid_exit)
>  
>  /*
>   * Save all registers in pt_regs, and switch gs if needed.
> - * Return: EBX=0: came from user mode; EBX=1: otherwise
>   */
>  ENTRY(error_entry)
>  	cld
> @@ -1087,7 +1086,6 @@ ENTRY(error_entry)
>  	 * for these here too.
>  	 */
>  .Lerror_kernelspace:
> -	incl	%ebx
>  	leaq	native_irq_return_iret(%rip), %rcx
>  	cmpq	%rcx, RIP+8(%rsp)
>  	je	.Lerror_bad_iret
> @@ -1119,28 +1117,19 @@ ENTRY(error_entry)
>  
>  	/*
>  	 * Pretend that the exception came from user mode: set up
> pt_regs
> -	 * as if we faulted immediately after IRET and clear EBX so
> that
> -	 * error_exit knows that we will be returning to user mode.
> +	 * as if we faulted immediately after IRET.
>  	 */
>  	mov	%rsp, %rdi
>  	call	fixup_bad_iret
>  	mov	%rax, %rsp
> -	decl	%ebx
>  	jmp	.Lerror_entry_from_usermode_after_swapgs
>  END(error_entry)
>  
> -
> -/*
> - * On entry, EBX is a "return to kernel mode" flag:
> - *   1: already in kernel mode, don't need SWAPGS
> - *   0: user gsbase is loaded, we need SWAPGS and standard
> preparation for return to usermode
> - */
>  ENTRY(error_exit)
> -	movl	%ebx, %eax
>  	DISABLE_INTERRUPTS(CLBR_NONE)
>  	TRACE_IRQS_OFF
> -	testl	%eax, %eax
> -	jnz	retint_kernel
> +	testb	$3, CS(%rsp)
> +	jz	retint_kernel
>  	jmp	retint_user
>  END(error_exit)
>  

[-- Attachment #1.2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5213 bytes --]

[-- Attachment #2: Type: text/plain, Size: 157 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
  2018-08-07 22:57 backport of XSA-274 patch to 4.9.x kernel (could use a review) Andy Lutomirski
@ 2018-08-08 17:35   ` Sarah Newman
  0 siblings, 0 replies; 13+ messages in thread
From: Sarah Newman @ 2018-08-08 17:35 UTC (permalink / raw)
  To: stable
  Cc: Sarah Newman, Brian Gerst, Borislav Petkov, Dominik Brodowski,
	Ingo Molnar, H. Peter Anvin, Thomas Gleixner, Boris Ostrovsky,
	Juergen Gross, xen-devel, x86, Andy Lutomirski

commit b3681dd548d06deb2e1573890829dff4b15abf46 upstream.

This version applies to v4.9.

>From Andy Lutomirski, original author:

error_entry and error_exit communicate the user vs kernel status of
the frame using %ebx.  This is unnecessary -- the information is in
regs->cs.  Just use regs->cs.

This makes error_entry simpler and makes error_exit more robust.

It also fixes a nasty bug.  Before all the Spectre nonsense, The
xen_failsafe_callback entry point returned like this:

        ALLOC_PT_GPREGS_ON_STACK
        SAVE_C_REGS
        SAVE_EXTRA_REGS
        ENCODE_FRAME_POINTER
        jmp     error_exit

And it did not go through error_entry.  This was bogus: RBX
contained garbage, and error_exit expected a flag in RBX.
Fortunately, it generally contained *nonzero* garbage, so the
correct code path was used.  As part of the Spectre fixes, code was
added to clear RBX to mitigate certain speculation attacks.  Now,
depending on kernel configuration, RBX got zeroed and, when running
some Wine workloads, the kernel crashes.  This was introduced by:

    commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
    exceptions/interrupts, to reduce speculation attack surface")

With this patch applied, RBX is no longer needed as a flag, and the
problem goes away.

I suspect that malicious userspace could use this bug to crash the
kernel even without the offending patch applied, though.

[Historical note: I wrote this patch as a cleanup before I was aware
 of the bug it fixed.]

[Note to stable maintainers: this should probably get applied to all
 kernels.]

Cc: Brian Gerst <brgerst@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: xen-devel@lists.xenproject.org
Cc: x86@kernel.org
Cc: stable@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Sarah Newman <srn@prgmr.com>
---
 arch/x86/entry/entry_64.S | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index d58d8dc..0dab47a 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -774,7 +774,7 @@ ENTRY(\sym)
 
 	call	\do_sym
 
-	jmp	error_exit			/* %ebx: no swapgs flag */
+	jmp	error_exit
 	.endif
 END(\sym)
 .endm
@@ -1043,7 +1043,6 @@ END(paranoid_exit)
 
 /*
  * Save all registers in pt_regs, and switch gs if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
 	cld
@@ -1087,7 +1086,6 @@ ENTRY(error_entry)
 	 * for these here too.
 	 */
 .Lerror_kernelspace:
-	incl	%ebx
 	leaq	native_irq_return_iret(%rip), %rcx
 	cmpq	%rcx, RIP+8(%rsp)
 	je	.Lerror_bad_iret
@@ -1119,28 +1117,19 @@ ENTRY(error_entry)
 
 	/*
 	 * Pretend that the exception came from user mode: set up pt_regs
-	 * as if we faulted immediately after IRET and clear EBX so that
-	 * error_exit knows that we will be returning to user mode.
+	 * as if we faulted immediately after IRET.
 	 */
 	mov	%rsp, %rdi
 	call	fixup_bad_iret
 	mov	%rax, %rsp
-	decl	%ebx
 	jmp	.Lerror_entry_from_usermode_after_swapgs
 END(error_entry)
 
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- *   1: already in kernel mode, don't need SWAPGS
- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
 ENTRY(error_exit)
-	movl	%ebx, %eax
 	DISABLE_INTERRUPTS(CLBR_NONE)
 	TRACE_IRQS_OFF
-	testl	%eax, %eax
-	jnz	retint_kernel
+	testb	$3, CS(%rsp)
+	jz	retint_kernel
 	jmp	retint_user
 END(error_exit)
 
-- 
1.9.1

^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
@ 2018-08-08 17:35   ` Sarah Newman
  0 siblings, 0 replies; 13+ messages in thread
From: Sarah Newman @ 2018-08-08 17:35 UTC (permalink / raw)
  To: stable
  Cc: Juergen Gross, x86, Brian Gerst, Sarah Newman, Dominik Brodowski,
	Ingo Molnar, Borislav Petkov, Andy Lutomirski, H. Peter Anvin,
	xen-devel, Thomas Gleixner, Boris Ostrovsky

commit b3681dd548d06deb2e1573890829dff4b15abf46 upstream.

This version applies to v4.9.

From Andy Lutomirski, original author:

error_entry and error_exit communicate the user vs kernel status of
the frame using %ebx.  This is unnecessary -- the information is in
regs->cs.  Just use regs->cs.

This makes error_entry simpler and makes error_exit more robust.

It also fixes a nasty bug.  Before all the Spectre nonsense, The
xen_failsafe_callback entry point returned like this:

        ALLOC_PT_GPREGS_ON_STACK
        SAVE_C_REGS
        SAVE_EXTRA_REGS
        ENCODE_FRAME_POINTER
        jmp     error_exit

And it did not go through error_entry.  This was bogus: RBX
contained garbage, and error_exit expected a flag in RBX.
Fortunately, it generally contained *nonzero* garbage, so the
correct code path was used.  As part of the Spectre fixes, code was
added to clear RBX to mitigate certain speculation attacks.  Now,
depending on kernel configuration, RBX got zeroed and, when running
some Wine workloads, the kernel crashes.  This was introduced by:

    commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
    exceptions/interrupts, to reduce speculation attack surface")

With this patch applied, RBX is no longer needed as a flag, and the
problem goes away.

I suspect that malicious userspace could use this bug to crash the
kernel even without the offending patch applied, though.

[Historical note: I wrote this patch as a cleanup before I was aware
 of the bug it fixed.]

[Note to stable maintainers: this should probably get applied to all
 kernels.]

Cc: Brian Gerst <brgerst@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: xen-devel@lists.xenproject.org
Cc: x86@kernel.org
Cc: stable@vger.kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Sarah Newman <srn@prgmr.com>
---
 arch/x86/entry/entry_64.S | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index d58d8dc..0dab47a 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -774,7 +774,7 @@ ENTRY(\sym)
 
 	call	\do_sym
 
-	jmp	error_exit			/* %ebx: no swapgs flag */
+	jmp	error_exit
 	.endif
 END(\sym)
 .endm
@@ -1043,7 +1043,6 @@ END(paranoid_exit)
 
 /*
  * Save all registers in pt_regs, and switch gs if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
 	cld
@@ -1087,7 +1086,6 @@ ENTRY(error_entry)
 	 * for these here too.
 	 */
 .Lerror_kernelspace:
-	incl	%ebx
 	leaq	native_irq_return_iret(%rip), %rcx
 	cmpq	%rcx, RIP+8(%rsp)
 	je	.Lerror_bad_iret
@@ -1119,28 +1117,19 @@ ENTRY(error_entry)
 
 	/*
 	 * Pretend that the exception came from user mode: set up pt_regs
-	 * as if we faulted immediately after IRET and clear EBX so that
-	 * error_exit knows that we will be returning to user mode.
+	 * as if we faulted immediately after IRET.
 	 */
 	mov	%rsp, %rdi
 	call	fixup_bad_iret
 	mov	%rax, %rsp
-	decl	%ebx
 	jmp	.Lerror_entry_from_usermode_after_swapgs
 END(error_entry)
 
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- *   1: already in kernel mode, don't need SWAPGS
- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
 ENTRY(error_exit)
-	movl	%ebx, %eax
 	DISABLE_INTERRUPTS(CLBR_NONE)
 	TRACE_IRQS_OFF
-	testl	%eax, %eax
-	jnz	retint_kernel
+	testb	$3, CS(%rsp)
+	jz	retint_kernel
 	jmp	retint_user
 END(error_exit)
 
-- 
1.9.1


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit
@ 2018-07-22 18:05 Andy Lutomirski
  0 siblings, 0 replies; 13+ messages in thread
From: Andy Lutomirski @ 2018-07-22 18:05 UTC (permalink / raw)
  To: x86, LKML
  Cc: Juergen Gross, H. Peter Anvin, Brian Gerst, Dave Hansen,
	Dominik Brodowski, Ingo Molnar, Borislav Petkov, stable,
	Andy Lutomirski, Greg KH, xen-devel, Thomas Gleixner,
	Linus Torvalds, Boris Ostrovsky

error_entry and error_exit communicate the user vs kernel status of
the frame using %ebx.  This is unnecessary -- the information is in
regs->cs.  Just use regs->cs.

This makes error_entry simpler and makes error_exit more robust.

It also fixes a nasty bug.  Before all the Spectre nonsense, The
xen_failsafe_callback entry point returned like this:

        ALLOC_PT_GPREGS_ON_STACK
        SAVE_C_REGS
        SAVE_EXTRA_REGS
        ENCODE_FRAME_POINTER
        jmp     error_exit

And it did not go through error_entry.  This was bogus: RBX
contained garbage, and error_exit expected a flag in RBX.
Fortunately, it generally contained *nonzero* garbage, so the
correct code path was used.  As part of the Spectre fixes, code was
added to clear RBX to mitigate certain speculation attacks.  Now,
depending on kernel configuration, RBX got zeroed and, when running
some Wine workloads, the kernel crashes.  This was introduced by:

    commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for
    exceptions/interrupts, to reduce speculation attack surface")

With this patch applied, RBX is no longer needed as a flag, and the
problem goes away.

I suspect that malicious userspace could use this bug to crash the
kernel even without the offending patch applied, though.

[Historical note: I wrote this patch as a cleanup before I was aware
 of the bug it fixed.]

[Note to stable maintainers: this should probably get applied to all
 kernels.  If you're nervous about that, a more conservative fix to
 add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
 also fix the problem.]

Cc: Brian Gerst <brgerst@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: xen-devel@lists.xenproject.org
Cc: x86@kernel.org
Cc: stable@vger.kernel.org
Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
Reported-and-tested-by: "M. Vefa Bicakci" <m.v.b@runbox.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---

I could also submit the conservative fix tagged for -stable and respin
this on top of it.  Ingo, Greg, what do you prefer?

 arch/x86/entry/entry_64.S | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 73a522d53b53..8ae7ffda8f98 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -981,7 +981,7 @@ ENTRY(\sym)
 
 	call	\do_sym
 
-	jmp	error_exit			/* %ebx: no swapgs flag */
+	jmp	error_exit
 	.endif
 END(\sym)
 .endm
@@ -1222,7 +1222,6 @@ END(paranoid_exit)
 
 /*
  * Save all registers in pt_regs, and switch GS if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
 	UNWIND_HINT_FUNC
@@ -1269,7 +1268,6 @@ ENTRY(error_entry)
 	 * for these here too.
 	 */
 .Lerror_kernelspace:
-	incl	%ebx
 	leaq	native_irq_return_iret(%rip), %rcx
 	cmpq	%rcx, RIP+8(%rsp)
 	je	.Lerror_bad_iret
@@ -1303,28 +1301,20 @@ ENTRY(error_entry)
 
 	/*
 	 * Pretend that the exception came from user mode: set up pt_regs
-	 * as if we faulted immediately after IRET and clear EBX so that
-	 * error_exit knows that we will be returning to user mode.
+	 * as if we faulted immediately after IRET.
 	 */
 	mov	%rsp, %rdi
 	call	fixup_bad_iret
 	mov	%rax, %rsp
-	decl	%ebx
 	jmp	.Lerror_entry_from_usermode_after_swapgs
 END(error_entry)
 
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- *   1: already in kernel mode, don't need SWAPGS
- *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
 ENTRY(error_exit)
 	UNWIND_HINT_REGS
 	DISABLE_INTERRUPTS(CLBR_ANY)
 	TRACE_IRQS_OFF
-	testl	%ebx, %ebx
-	jnz	retint_kernel
+	testb	$3, CS(%rsp)
+	jz	retint_kernel
 	jmp	retint_user
 END(error_exit)
 
-- 
2.17.1


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

^ permalink raw reply	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2018-08-16 15:36 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-22 18:05 [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Andy Lutomirski
2018-07-23  7:25 ` Greg KH
2018-07-24  2:31   ` Andy Lutomirski
2018-07-24  2:31   ` Andy Lutomirski
2018-07-23  7:25 ` Greg KH
2018-07-24 15:03 ` [tip:x86/urgent] " tip-bot for Andy Lutomirski
  -- strict thread matches above, loose matches on Subject: below --
2018-08-07 22:57 backport of XSA-274 patch to 4.9.x kernel (could use a review) Andy Lutomirski
2018-08-08 17:35 ` [PATCH] x86/entry/64: Remove %ebx handling from error_entry/exit Sarah Newman
2018-08-08 17:35   ` Sarah Newman
2018-08-09 12:41   ` David Woodhouse
2018-08-09 12:41   ` [Xen-devel] " David Woodhouse
2018-08-10  7:23     ` Sarah Newman
2018-08-10  7:23     ` [Xen-devel] " Sarah Newman
2018-08-16 15:19       ` Greg KH
2018-08-16 15:35         ` Andy Lutomirski
2018-08-16 15:19       ` Greg KH
2018-07-22 18:05 Andy Lutomirski

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.