LKML Archive on lore.kernel.org
 help / color / Atom feed
* [tip:x86/urgent] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels
@ 2014-04-11 17:36 tip-bot for H. Peter Anvin
  2014-04-11 18:12 ` Andy Lutomirski
                   ` (2 more replies)
  0 siblings, 3 replies; 136+ messages in thread
From: tip-bot for H. Peter Anvin @ 2014-04-11 17:36 UTC (permalink / raw)
  To: linux-tip-commits; +Cc: linux-kernel, hpa, mingo, torvalds, stable, tglx, hpa

Commit-ID:  b3b42ac2cbae1f3cecbb6229964a4d48af31d382
Gitweb:     http://git.kernel.org/tip/b3b42ac2cbae1f3cecbb6229964a4d48af31d382
Author:     H. Peter Anvin <hpa@linux.intel.com>
AuthorDate: Sun, 16 Mar 2014 15:31:54 -0700
Committer:  H. Peter Anvin <hpa@linux.intel.com>
CommitDate: Fri, 11 Apr 2014 10:10:09 -0700

x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels

The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer.  We have
a software workaround for that ("espfix") for the 32-bit kernel, but
it relies on a nonzero stack segment base which is not available in
32-bit mode.

Since 16-bit support is somewhat crippled anyway on a 64-bit kernel
(no V86 mode), and most (if not quite all) 64-bit processors support
virtualization for the users who really need it, simply reject
attempts at creating a 16-bit segment when running on top of a 64-bit
kernel.

Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/n/tip-kicdm89kzw9lldryb1br9od0@git.kernel.org
Cc: <stable@vger.kernel.org>
---
 arch/x86/kernel/ldt.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index ebc9873..af1d14a 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -229,6 +229,17 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
 		}
 	}
 
+	/*
+	 * On x86-64 we do not support 16-bit segments due to
+	 * IRET leaking the high bits of the kernel stack address.
+	 */
+#ifdef CONFIG_X86_64
+	if (!ldt_info.seg_32bit) {
+		error = -EINVAL;
+		goto out_unlock;
+	}
+#endif
+
 	fill_ldt(&ldt, &ldt_info);
 	if (oldmode)
 		ldt.avl = 0;

^ permalink raw reply	[flat|nested] 136+ messages in thread

end of thread, back to index

Thread overview: 136+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-04-11 17:36 [tip:x86/urgent] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels tip-bot for H. Peter Anvin
2014-04-11 18:12 ` Andy Lutomirski
2014-04-11 18:20   ` H. Peter Anvin
2014-04-11 18:27 ` Brian Gerst
2014-04-11 18:29   ` H. Peter Anvin
2014-04-11 18:35     ` Brian Gerst
2014-04-11 21:16     ` Andy Lutomirski
2014-04-11 21:24       ` H. Peter Anvin
2014-04-11 21:53         ` Andy Lutomirski
2014-04-11 21:59           ` H. Peter Anvin
2014-04-11 22:15             ` Andy Lutomirski
2014-04-11 22:18               ` H. Peter Anvin
2014-04-13  4:20           ` H. Peter Anvin
2014-04-12 23:26         ` Alexander van Heukelum
2014-04-12 23:31           ` H. Peter Anvin
2014-04-12 23:49             ` Alexander van Heukelum
2014-04-13  0:03               ` H. Peter Anvin
2014-04-13  1:25                 ` Andy Lutomirski
2014-04-13  1:29                   ` Andy Lutomirski
2014-04-13  3:00                     ` H. Peter Anvin
2014-04-11 21:34       ` Linus Torvalds
2014-04-11 18:41   ` Linus Torvalds
2014-04-11 18:45     ` Brian Gerst
2014-04-11 18:50       ` Linus Torvalds
2014-04-12  4:44         ` Brian Gerst
2014-04-12 17:18           ` H. Peter Anvin
2014-04-12 19:35             ` Borislav Petkov
2014-04-12 19:44               ` H. Peter Anvin
2014-04-12 20:11                 ` Borislav Petkov
2014-04-12 20:34                   ` Brian Gerst
2014-04-12 20:59                     ` Borislav Petkov
2014-04-12 21:13                       ` Brian Gerst
2014-04-12 21:40                         ` Borislav Petkov
2014-04-14  7:21                           ` Ingo Molnar
2014-04-14  9:44                             ` Borislav Petkov
2014-04-14  9:47                               ` Ingo Molnar
2014-04-12 21:53                 ` Linus Torvalds
2014-04-12 22:25                   ` H. Peter Anvin
2014-04-13  2:56                     ` Andi Kleen
2014-04-13  3:02                       ` H. Peter Anvin
2014-04-13  3:13                       ` Linus Torvalds
2014-04-12 20:29             ` Brian Gerst
2014-04-14  7:48         ` Alexandre Julliard
2014-05-07  9:18           ` Sven Joachim
2014-05-07 10:18             ` Borislav Petkov
2014-05-07 16:57             ` Linus Torvalds
2014-05-07 17:09               ` H. Peter Anvin
2014-05-07 17:50                 ` Alexandre Julliard
2014-05-08  6:43                 ` Sven Joachim
2014-05-08 13:50                   ` H. Peter Anvin
2014-05-08 20:13                     ` H. Peter Anvin
2014-05-08 20:40                     ` H. Peter Anvin
2014-05-12 13:16               ` Josh Boyer
2014-05-12 16:52                 ` H. Peter Anvin
2014-05-14 23:43               ` [tip:x86/urgent] x86-64, modify_ldt: Make support for 16-bit segments a runtime option tip-bot for Linus Torvalds
2014-04-11 18:46     ` [tip:x86/urgent] x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels H. Peter Anvin
2014-04-14  7:27       ` Ingo Molnar
2014-04-14 15:45         ` H. Peter Anvin
2014-04-13  2:54     ` Andi Kleen
2014-04-21 22:47 ` [PATCH] x86-64: espfix for 64-bit mode *PROTOTYPE* H. Peter Anvin
2014-04-21 23:19   ` Andrew Lutomirski
2014-04-21 23:29     ` H. Peter Anvin
2014-04-22  0:37       ` Andrew Lutomirski
2014-04-22  0:53         ` H. Peter Anvin
2014-04-22  1:06           ` Andrew Lutomirski
2014-04-22  1:14             ` H. Peter Anvin
2014-04-22  1:28               ` Andrew Lutomirski
2014-04-22  1:47                 ` H. Peter Anvin
2014-04-22  1:53                   ` Andrew Lutomirski
2014-04-22 11:23                     ` Borislav Petkov
2014-04-22 14:46                       ` Borislav Petkov
2014-04-22 16:03                         ` Andrew Lutomirski
2014-04-22 16:10                           ` H. Peter Anvin
2014-04-22 16:33                             ` Andrew Lutomirski
2014-04-22 16:43                               ` Linus Torvalds
2014-04-22 17:00                                 ` Andrew Lutomirski
2014-04-22 17:04                                   ` Linus Torvalds
2014-04-22 17:11                                     ` Andrew Lutomirski
2014-04-22 17:15                                       ` H. Peter Anvin
2014-04-23  9:54                                         ` One Thousand Gnomes
2014-04-23 15:53                                           ` H. Peter Anvin
2014-04-23 17:08                                             ` Andrew Lutomirski
2014-04-23 17:16                                               ` H. Peter Anvin
2014-04-23 17:25                                                 ` Andrew Lutomirski
2014-04-23 17:28                                                   ` H. Peter Anvin
2014-04-23 17:45                                                     ` Andrew Lutomirski
2014-04-22 17:19                                       ` Linus Torvalds
2014-04-22 17:29                                         ` H. Peter Anvin
2014-04-22 17:46                                           ` Andrew Lutomirski
2014-04-22 17:59                                             ` H. Peter Anvin
2014-04-22 18:03                                             ` Brian Gerst
2014-04-22 18:06                                               ` H. Peter Anvin
2014-04-22 18:17                                                 ` Brian Gerst
2014-04-22 18:51                                                   ` H. Peter Anvin
2014-04-22 19:55                                                     ` Brian Gerst
2014-04-22 20:17                                                       ` H. Peter Anvin
2014-04-22 23:08                                                         ` Brian Gerst
2014-04-22 23:39                                                     ` Andi Kleen
2014-04-22 23:40                                                       ` H. Peter Anvin
2014-04-22 17:11                                     ` H. Peter Anvin
2014-04-22 17:26                                       ` Borislav Petkov
2014-04-22 17:29                                         ` Andrew Lutomirski
2014-04-22 19:27                                           ` Borislav Petkov
2014-04-23  6:24                                     ` H. Peter Anvin
2014-04-23  8:57                                       ` Alexandre Julliard
2014-04-22 17:09                                   ` H. Peter Anvin
2014-04-22 17:20                                     ` Andrew Lutomirski
2014-04-22 17:24                                       ` H. Peter Anvin
2014-04-22 11:25   ` Borislav Petkov
2014-04-23  1:17   ` H. Peter Anvin
2014-04-23  1:23     ` Andrew Lutomirski
2014-04-23  1:42       ` H. Peter Anvin
2014-04-23 14:24         ` Boris Ostrovsky
2014-04-23 16:56           ` H. Peter Anvin
2014-04-28 13:04             ` Konrad Rzeszutek Wilk
2014-04-25 21:02     ` Konrad Rzeszutek Wilk
2014-04-25 21:16       ` H. Peter Anvin
2014-04-24  4:13   ` comex
2014-04-24  4:53     ` Andrew Lutomirski
2014-04-24 22:24       ` H. Peter Anvin
2014-04-24 22:31         ` Andrew Lutomirski
2014-04-24 22:37           ` H. Peter Anvin
2014-04-24 22:43             ` Andrew Lutomirski
2014-04-28 23:05       ` H. Peter Anvin
2014-04-28 23:08         ` H. Peter Anvin
2014-04-29  0:02           ` Andrew Lutomirski
2014-04-29  0:15             ` H. Peter Anvin
2014-04-29  0:20             ` Andrew Lutomirski
2014-04-29  2:38               ` H. Peter Anvin
2014-04-29  2:44                 ` H. Peter Anvin
2014-04-29  3:45                 ` H. Peter Anvin
2014-04-29  3:47                   ` H. Peter Anvin
2014-04-29  4:36                   ` H. Peter Anvin
2014-04-29  7:14                     ` H. Peter Anvin
2014-04-25 12:02   ` Pavel Machek
2014-04-25 21:20     ` H. Peter Anvin

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git
	git clone --mirror https://lore.kernel.org/lkml/10 lkml/git/10.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git