• Linus Torvalds's avatar
    x86-32: Fix kexec with stack canary (CONFIG_CC_STACKPROTECTOR) · ac461122
    Linus Torvalds authored
    Commit e802a51e ("x86/idt: Consolidate IDT invalidation") cleaned up
    and unified the IDT invalidation that existed in a couple of places.  It
    changed no actual real code.
    
    Despite not changing any actual real code, it _did_ change code generation:
    by implementing the common idt_invalidate() function in
    archx86/kernel/idt.c, it made the use of the function in
    arch/x86/kernel/machine_kexec_32.c be a real function call rather than an
    (accidental) inlining of the function.
    
    That, in turn, exposed two issues:
    
     - in load_segments(), we had incorrectly reset all the segment
       registers, which then made the stack canary load (which gcc does
       using offset of %gs) cause a trap.  Instead of %gs pointing to the
       stack canary, it will be the normal zero-based kernel segment, and
       the stack canary load will take a page fault at address 0x14.
    
     - to make this even harder to debug, we had invalidated the GDT just
       before calling idt_invalidate(), which meant that the fault happened
       with an invalid GDT, which in turn causes a triple fault and
       immediate reboot.
    
    Fix this by
    
     (a) not reloading the special segments in load_segments(). We currently
         don't do any percpu accesses (which would require %fs on x86-32) in
         this area, but there's no reason to think that we might not want to
         do them, and like %gs, it's pointless to break it.
    
     (b) doing idt_invalidate() before invalidating the GDT, to keep things
         at least _slightly_ more debuggable for a bit longer. Without a
         IDT, traps will not work. Without a GDT, traps also will not work,
         but neither will any segment loads etc. So in a very real sense,
         the GDT is even more core than the IDT.
    
    Fixes: e802a51e ("x86/idt: Consolidate IDT invalidation")
    Reported-and-tested-by: default avatarAlexandru Chirvasitu <achirvasub@gmail.com>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/alpine.LFD.2.21.1712271143180.8572@i7.lan
    ac461122
machine_kexec_32.c 6.69 KB