From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756848AbbGGKun (ORCPT ); Tue, 7 Jul 2015 06:50:43 -0400 Received: from terminus.zytor.com ([198.137.202.10]:59871 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756670AbbGGKu2 (ORCPT ); Tue, 7 Jul 2015 06:50:28 -0400 Date: Tue, 7 Jul 2015 03:49:27 -0700 From: tip-bot for Andy Lutomirski Message-ID: Cc: dvlasenk@redhat.com, bp@alien8.de, oleg@redhat.com, fweisbec@gmail.com, riel@redhat.com, vda.linux@googlemail.com, keescook@chromium.org, luto@amacapital.net, hpa@zytor.com, torvalds@linux-foundation.org, linux-kernel@vger.kernel.org, peterz@infradead.org, mingo@kernel.org, brgerst@gmail.com, luto@kernel.org, tglx@linutronix.de Reply-To: tglx@linutronix.de, luto@kernel.org, brgerst@gmail.com, peterz@infradead.org, mingo@kernel.org, hpa@zytor.com, luto@amacapital.net, keescook@chromium.org, torvalds@linux-foundation.org, linux-kernel@vger.kernel.org, oleg@redhat.com, vda.linux@googlemail.com, riel@redhat.com, fweisbec@gmail.com, dvlasenk@redhat.com, bp@alien8.de In-Reply-To: <903010762c07a3d67df914fea2da84b52b0f8f1d.1435952415.git.luto@kernel.org> References: <903010762c07a3d67df914fea2da84b52b0f8f1d.1435952415.git.luto@kernel.org> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/asm] x86/entry/64/compat: Fix bad fast syscall arg failure path Git-Commit-ID: 5e99cb7c35ca0580da8e892f91c655d35ecf8798 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 5e99cb7c35ca0580da8e892f91c655d35ecf8798 Gitweb: http://git.kernel.org/tip/5e99cb7c35ca0580da8e892f91c655d35ecf8798 Author: Andy Lutomirski AuthorDate: Fri, 3 Jul 2015 12:44:19 -0700 Committer: Ingo Molnar CommitDate: Tue, 7 Jul 2015 10:58:30 +0200 x86/entry/64/compat: Fix bad fast syscall arg failure path If user code does SYSCALL32 or SYSENTER without a valid stack, then our attempt to determine the syscall args will result in a failed uaccess fault. Previously, we would try to recover by jumping to the syscall exit code, but we'd run the syscall exit work even though we never made it to the syscall entry work. Clean it up by treating the failure path as a non-syscall entry and exit pair. This fixes strace's output when running the syscall_arg_fault test. Without this fix, strace would get out of sync and would fail to associate syscall entries with syscall exits. Signed-off-by: Andy Lutomirski Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: Denys Vlasenko Cc: Frederic Weisbecker Cc: H. Peter Anvin Cc: Kees Cook Cc: Linus Torvalds Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Rik van Riel Cc: Thomas Gleixner Cc: paulmck@linux.vnet.ibm.com Link: http://lkml.kernel.org/r/903010762c07a3d67df914fea2da84b52b0f8f1d.1435952415.git.luto@kernel.org Signed-off-by: Ingo Molnar --- arch/x86/entry/entry_64.S | 2 +- arch/x86/entry/entry_64_compat.S | 35 +++++++++++++++++++++++++++++++++-- 2 files changed, 34 insertions(+), 3 deletions(-) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index 3bb2c43..141a5d4 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -613,7 +613,7 @@ ret_from_intr: testb $3, CS(%rsp) jz retint_kernel /* Interrupt came from user space */ -retint_user: +GLOBAL(retint_user) GET_THREAD_INFO(%rcx) /* %rcx: thread info. Interrupts are off. */ diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S index b868cfc..e5ebdd9 100644 --- a/arch/x86/entry/entry_64_compat.S +++ b/arch/x86/entry/entry_64_compat.S @@ -428,8 +428,39 @@ cstar_tracesys: END(entry_SYSCALL_compat) ia32_badarg: - ASM_CLAC - movq $-EFAULT, RAX(%rsp) + /* + * So far, we've entered kernel mode, set AC, turned on IRQs, and + * saved C regs except r8-r11. We haven't done any of the other + * standard entry work, though. We want to bail, but we shouldn't + * treat this as a syscall entry since we don't even know what the + * args are. Instead, treat this as a non-syscall entry, finish + * the entry work, and immediately exit after setting AX = -EFAULT. + * + * We're really just being polite here. Killing the task outright + * would be a reasonable action, too. Given that the only valid + * way to have gotten here is through the vDSO, and we already know + * that the stack pointer is bad, the task isn't going to survive + * for long no matter what we do. + */ + + ASM_CLAC /* undo STAC */ + movq $-EFAULT, RAX(%rsp) /* return -EFAULT if possible */ + + /* Fill in the rest of pt_regs */ + xorl %eax, %eax + movq %rax, R11(%rsp) + movq %rax, R10(%rsp) + movq %rax, R9(%rsp) + movq %rax, R8(%rsp) + SAVE_EXTRA_REGS + + /* Turn IRQs back off. */ + DISABLE_INTERRUPTS(CLBR_NONE) + TRACE_IRQS_OFF + + /* And exit again. */ + jmp retint_user + ia32_ret_from_sys_call: xorl %eax, %eax /* Do not leak kernel information */ movq %rax, R11(%rsp)