Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

x86_64, entry: Fix out of bounds read on sysenter

Rusty noticed a Really Bad Bug (tm) in my NT fix. The entry code
reads out of bounds, causing the NT fix to be unreliable. But, and
this is much, much worse, if your stack is somehow just below the
top of the direct map (or a hole), you read out of bounds and crash.

Excerpt from the crash:

[ 1.129513] RSP: 0018:ffff88001da4bf88 EFLAGS: 00010296

2b:* f7 84 24 90 00 00 00 testl $0x4000,0x90(%rsp)

That read is deterministically above the top of the stack. I
thought I even single-stepped through this code when I wrote it to
check the offset, but I clearly screwed it up.

Fixes: 8c7aa698baca ("x86_64, entry: Filter RFLAGS.NT on entry from userspace")
Reported-by: Rusty Russell <rusty@ozlabs.org>
Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Andy Lutomirski and committed by
Linus Torvalds
653bc77a 32e8fd2f

+1 -1
+1 -1
arch/x86/ia32/ia32entry.S
··· 157 157 * ourselves. To save a few cycles, we can check whether 158 158 * NT was set instead of doing an unconditional popfq. 159 159 */ 160 - testl $X86_EFLAGS_NT,EFLAGS(%rsp) /* saved EFLAGS match cpu */ 160 + testl $X86_EFLAGS_NT,EFLAGS-ARGOFFSET(%rsp) 161 161 jnz sysenter_fix_flags 162 162 sysenter_flags_fixed: 163 163