[kernel] r22309 - in dists/squeeze-security/linux-2.6/debian: . patches/bugfix/x86 patches/series
Ben Hutchings
benh at moszumanska.debian.org
Fri Jan 30 04:51:02 UTC 2015
Author: benh
Date: Fri Jan 30 04:51:02 2015
New Revision: 22309
Log:
[amd64] switch_to(): Load TLS descriptors before switching DS and ES (CVE-2014-9419)
Added:
dists/squeeze-security/linux-2.6/debian/patches/bugfix/x86/x86_64-switch_to-load-tls-descriptors-before-switchi.patch
Modified:
dists/squeeze-security/linux-2.6/debian/changelog
dists/squeeze-security/linux-2.6/debian/patches/series/48squeeze11
Modified: dists/squeeze-security/linux-2.6/debian/changelog
==============================================================================
--- dists/squeeze-security/linux-2.6/debian/changelog Fri Jan 30 04:50:25 2015 (r22308)
+++ dists/squeeze-security/linux-2.6/debian/changelog Fri Jan 30 04:51:02 2015 (r22309)
@@ -30,6 +30,8 @@
- i387: move TS_USEDFPU flag from thread_info to task_struct
- i387: re-introduce FPU state preloading at context switch time
* Ignore ABI change for math_state_restore(), not used out-of-tree
+ * [amd64] switch_to(): Load TLS descriptors before switching DS and ES
+ (CVE-2014-9419)
-- Ben Hutchings <ben at decadent.org.uk> Wed, 28 Jan 2015 22:33:05 +0000
Added: dists/squeeze-security/linux-2.6/debian/patches/bugfix/x86/x86_64-switch_to-load-tls-descriptors-before-switchi.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/squeeze-security/linux-2.6/debian/patches/bugfix/x86/x86_64-switch_to-load-tls-descriptors-before-switchi.patch Fri Jan 30 04:51:02 2015 (r22309)
@@ -0,0 +1,306 @@
+From: Andy Lutomirski <luto at amacapital.net>
+Date: Mon, 8 Dec 2014 13:55:20 -0800
+Subject: x86_64, switch_to(): Load TLS descriptors before switching DS and ES
+Origin: https://git.kernel.org/linus/f647d7c155f069c1a068030255c300663516420e
+
+Otherwise, if buggy user code points DS or ES into the TLS
+array, they would be corrupted after a context switch.
+
+This also significantly improves the comments and documents some
+gotchas in the code.
+
+Before this patch, the both tests below failed. With this
+patch, the es test passes, although the gsbase test still fails.
+
+ ----- begin es test -----
+
+/*
+ * Copyright (c) 2014 Andy Lutomirski
+ * GPL v2
+ */
+
+static unsigned short GDT3(int idx)
+{
+ return (idx << 3) | 3;
+}
+
+static int create_tls(int idx, unsigned int base)
+{
+ struct user_desc desc = {
+ .entry_number = idx,
+ .base_addr = base,
+ .limit = 0xfffff,
+ .seg_32bit = 1,
+ .contents = 0, /* Data, grow-up */
+ .read_exec_only = 0,
+ .limit_in_pages = 1,
+ .seg_not_present = 0,
+ .useable = 0,
+ };
+
+ if (syscall(SYS_set_thread_area, &desc) != 0)
+ err(1, "set_thread_area");
+
+ return desc.entry_number;
+}
+
+int main()
+{
+ int idx = create_tls(-1, 0);
+ printf("Allocated GDT index %d\n", idx);
+
+ unsigned short orig_es;
+ asm volatile ("mov %%es,%0" : "=rm" (orig_es));
+
+ int errors = 0;
+ int total = 1000;
+ for (int i = 0; i < total; i++) {
+ asm volatile ("mov %0,%%es" : : "rm" (GDT3(idx)));
+ usleep(100);
+
+ unsigned short es;
+ asm volatile ("mov %%es,%0" : "=rm" (es));
+ asm volatile ("mov %0,%%es" : : "rm" (orig_es));
+ if (es != GDT3(idx)) {
+ if (errors == 0)
+ printf("[FAIL]\tES changed from 0x%hx to 0x%hx\n",
+ GDT3(idx), es);
+ errors++;
+ }
+ }
+
+ if (errors) {
+ printf("[FAIL]\tES was corrupted %d/%d times\n", errors, total);
+ return 1;
+ } else {
+ printf("[OK]\tES was preserved\n");
+ return 0;
+ }
+}
+
+ ----- end es test -----
+
+ ----- begin gsbase test -----
+
+/*
+ * gsbase.c, a gsbase test
+ * Copyright (c) 2014 Andy Lutomirski
+ * GPL v2
+ */
+
+static unsigned char *testptr, *testptr2;
+
+static unsigned char read_gs_testvals(void)
+{
+ unsigned char ret;
+ asm volatile ("movb %%gs:%1, %0" : "=r" (ret) : "m" (*testptr));
+ return ret;
+}
+
+int main()
+{
+ int errors = 0;
+
+ testptr = mmap((void *)0x200000000UL, 1, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
+ if (testptr == MAP_FAILED)
+ err(1, "mmap");
+
+ testptr2 = mmap((void *)0x300000000UL, 1, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
+ if (testptr2 == MAP_FAILED)
+ err(1, "mmap");
+
+ *testptr = 0;
+ *testptr2 = 1;
+
+ if (syscall(SYS_arch_prctl, ARCH_SET_GS,
+ (unsigned long)testptr2 - (unsigned long)testptr) != 0)
+ err(1, "ARCH_SET_GS");
+
+ usleep(100);
+
+ if (read_gs_testvals() == 1) {
+ printf("[OK]\tARCH_SET_GS worked\n");
+ } else {
+ printf("[FAIL]\tARCH_SET_GS failed\n");
+ errors++;
+ }
+
+ asm volatile ("mov %0,%%gs" : : "r" (0));
+
+ if (read_gs_testvals() == 0) {
+ printf("[OK]\tWriting 0 to gs worked\n");
+ } else {
+ printf("[FAIL]\tWriting 0 to gs failed\n");
+ errors++;
+ }
+
+ usleep(100);
+
+ if (read_gs_testvals() == 0) {
+ printf("[OK]\tgsbase is still zero\n");
+ } else {
+ printf("[FAIL]\tgsbase was corrupted\n");
+ errors++;
+ }
+
+ return errors == 0 ? 0 : 1;
+}
+
+ ----- end gsbase test -----
+
+Signed-off-by: Andy Lutomirski <luto at amacapital.net>
+Cc: <stable at vger.kernel.org>
+Cc: Andi Kleen <andi at firstfloor.org>
+Cc: Linus Torvalds <torvalds at linux-foundation.org>
+Link: http://lkml.kernel.org/r/509d27c9fec78217691c3dad91cec87e1006b34a.1418075657.git.luto@amacapital.net
+Signed-off-by: Ingo Molnar <mingo at kernel.org>
+---
+ arch/x86/kernel/process_64.c | 101 +++++++++++++++++++++++++++++++------------
+ 1 file changed, 73 insertions(+), 28 deletions(-)
+
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 3ed4a68..5a2c029 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -385,24 +385,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+
+ fpu = switch_fpu_prepare(prev_p, next_p);
+
+- /*
+- * Reload esp0, LDT and the page table pointer:
+- */
++ /* Reload esp0 and ss1. */
+ load_sp0(tss, next);
+
+- /*
+- * Switch DS and ES.
+- * This won't pick up thread selector changes, but I guess that is ok.
+- */
+- savesegment(es, prev->es);
+- if (unlikely(next->es | prev->es))
+- loadsegment(es, next->es);
+-
+- savesegment(ds, prev->ds);
+- if (unlikely(next->ds | prev->ds))
+- loadsegment(ds, next->ds);
+-
+-
+ /* We must save %fs and %gs before load_TLS() because
+ * %fs and %gs may be cleared by load_TLS().
+ *
+@@ -411,41 +396,101 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ savesegment(fs, fsindex);
+ savesegment(gs, gsindex);
+
++ /*
++ * Load TLS before restoring any segments so that segment loads
++ * reference the correct GDT entries.
++ */
+ load_TLS(next, cpu);
+
+ /*
+- * Leave lazy mode, flushing any hypercalls made here.
+- * This must be done before restoring TLS segments so
+- * the GDT and LDT are properly updated, and must be
+- * done before math_state_restore, so the TS bit is up
+- * to date.
++ * Leave lazy mode, flushing any hypercalls made here. This
++ * must be done after loading TLS entries in the GDT but before
++ * loading segments that might reference them, and and it must
++ * be done before math_state_restore, so the TS bit is up to
++ * date.
+ */
+ arch_end_context_switch(next_p);
+
++ /* Switch DS and ES.
++ *
++ * Reading them only returns the selectors, but writing them (if
++ * nonzero) loads the full descriptor from the GDT or LDT. The
++ * LDT for next is loaded in switch_mm, and the GDT is loaded
++ * above.
++ *
++ * We therefore need to write new values to the segment
++ * registers on every context switch unless both the new and old
++ * values are zero.
++ *
++ * Note that we don't need to do anything for CS and SS, as
++ * those are saved and restored as part of pt_regs.
++ */
++ savesegment(es, prev->es);
++ if (unlikely(next->es | prev->es))
++ loadsegment(es, next->es);
++
++ savesegment(ds, prev->ds);
++ if (unlikely(next->ds | prev->ds))
++ loadsegment(ds, next->ds);
++
+ /*
+ * Switch FS and GS.
+ *
+- * Segment register != 0 always requires a reload. Also
+- * reload when it has changed. When prev process used 64bit
+- * base always reload to avoid an information leak.
++ * These are even more complicated than FS and GS: they have
++ * 64-bit bases are that controlled by arch_prctl. Those bases
++ * only differ from the values in the GDT or LDT if the selector
++ * is 0.
++ *
++ * Loading the segment register resets the hidden base part of
++ * the register to 0 or the value from the GDT / LDT. If the
++ * next base address zero, writing 0 to the segment register is
++ * much faster than using wrmsr to explicitly zero the base.
++ *
++ * The thread_struct.fs and thread_struct.gs values are 0
++ * if the fs and gs bases respectively are not overridden
++ * from the values implied by fsindex and gsindex. They
++ * are nonzero, and store the nonzero base addresses, if
++ * the bases are overridden.
++ *
++ * (fs != 0 && fsindex != 0) || (gs != 0 && gsindex != 0) should
++ * be impossible.
++ *
++ * Therefore we need to reload the segment registers if either
++ * the old or new selector is nonzero, and we need to override
++ * the base address if next thread expects it to be overridden.
++ *
++ * This code is unnecessarily slow in the case where the old and
++ * new indexes are zero and the new base is nonzero -- it will
++ * unnecessarily write 0 to the selector before writing the new
++ * base address.
++ *
++ * Note: This all depends on arch_prctl being the only way that
++ * user code can override the segment base. Once wrfsbase and
++ * wrgsbase are enabled, most of this code will need to change.
+ */
+ if (unlikely(fsindex | next->fsindex | prev->fs)) {
+ loadsegment(fs, next->fsindex);
++
+ /*
+- * Check if the user used a selector != 0; if yes
+- * clear 64bit base, since overloaded base is always
+- * mapped to the Null selector
++ * If user code wrote a nonzero value to FS, then it also
++ * cleared the overridden base address.
++ *
++ * XXX: if user code wrote 0 to FS and cleared the base
++ * address itself, we won't notice and we'll incorrectly
++ * restore the prior base address next time we reschdule
++ * the process.
+ */
+ if (fsindex)
+ prev->fs = 0;
+ }
+- /* when next process has a 64bit base use it */
+ if (next->fs)
+ wrmsrl(MSR_FS_BASE, next->fs);
+ prev->fsindex = fsindex;
+
+ if (unlikely(gsindex | next->gsindex | prev->gs)) {
+ load_gs_index(next->gsindex);
++
++ /* This works (and fails) the same way as fsindex above. */
+ if (gsindex)
+ prev->gs = 0;
+ }
Modified: dists/squeeze-security/linux-2.6/debian/patches/series/48squeeze11
==============================================================================
--- dists/squeeze-security/linux-2.6/debian/patches/series/48squeeze11 Fri Jan 30 04:50:25 2015 (r22308)
+++ dists/squeeze-security/linux-2.6/debian/patches/series/48squeeze11 Fri Jan 30 04:51:02 2015 (r22309)
@@ -29,3 +29,5 @@
+ bugfix/x86/0015-i387-re-introduce-fpu-state-preloading-at-context-sw.patch
+ bugfix/x86/x86-fpu-avoid-abi-change-for-addition-of-has_fpu-fla.patch
+
++ bugfix/x86/x86_64-switch_to-load-tls-descriptors-before-switchi.patch
More information about the Kernel-svn-changes
mailing list