• Andy Lutomirski's avatar
    x86/entry/64: Remove %ebx handling from error_entry/exit · b3681dd5
    Andy Lutomirski authored
    error_entry and error_exit communicate the user vs. kernel status of
    the frame using %ebx.  This is unnecessary -- the information is in
    regs->cs.  Just use regs->cs.
    
    This makes error_entry simpler and makes error_exit more robust.
    
    It also fixes a nasty bug.  Before all the Spectre nonsense, the
    xen_failsafe_callback entry point returned like this:
    
            ALLOC_PT_GPREGS_ON_STACK
            SAVE_C_REGS
            SAVE_EXTRA_REGS
            ENCODE_FRAME_POINTER
            jmp     error_exit
    
    And it did not go through error_entry.  This was bogus: RBX
    contained garbage, and error_exit expected a flag in RBX.
    
    Fortunately, it generally contained *nonzero* garbage, so the
    correct code path was used.  As part of the Spectre fixes, code was
    added to clear RBX to mitigate certain speculation attacks.  Now,
    depending on kernel configuration, RBX got zeroed and, when running
    some Wine workloads, the kernel crashes.  This was introduced by:
    
        commit 3ac6d8c7 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
    
    With this patch applied, RBX is no longer needed as a flag, and the
    problem goes away.
    
    I suspect that malicious userspace could use this bug to crash the
    kernel even without the offending patch applied, though.
    
    [ Historical note: I wrote this patch as a cleanup before I was aware
      of the bug it fixed. ]
    
    [ Note to stable maintainers: this should probably get applied to all
      kernels.  If you're nervous about that, a more conservative fix to
      add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
      also fix the problem. ]
    Reported-and-tested-by: default avatarM. Vefa Bicakci <m.v.b@runbox.com>
    Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
    Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: Dominik Brodowski <linux@dominikbrodowski.net>
    Cc: Greg KH <gregkh@linuxfoundation.org>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Juergen Gross <jgross@suse.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org
    Cc: xen-devel@lists.xenproject.org
    Fixes: 3ac6d8c7 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
    Link: http://lkml.kernel.org/r/b5010a090d3586b2d6e06c7ad3ec5542d1241c45.1532282627.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    b3681dd5
entry_64.S 46 KB