Commit 3891a04a authored by H. Peter Anvin's avatar H. Peter Anvin
Browse files

x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack 



The IRET instruction, when returning to a 16-bit segment, only
restores the bottom 16 bits of the user space stack pointer.  This
causes some 16-bit software to break, but it also leaks kernel state
to user space.  We have a software workaround for that ("espfix") for
the 32-bit kernel, but it relies on a nonzero stack segment base which
is not available in 64-bit mode.

In checkin:

    b3b42ac2 x86-64, modify_ldt: Ban 16-bit segments on 64-bit kernels

we "solved" this by forbidding 16-bit segments on 64-bit kernels, with
the logic that 16-bit support is crippled on 64-bit kernels anyway (no
V86 support), but it turns out that people are doing stuff like
running old Win16 binaries under Wine and expect it to work.

This works around this by creating percpu "ministacks", each of which
is mapped 2^16 times 64K apart.  When we detect that the return SS is
on the LDT, we copy the IRET frame to the ministack and use the
relevant alias to return to userspace.  The ministacks are mapped
readonly, so if IRET faults we promote #GP to #DF which is an IST
vector and thus has its own stack; we then do the fixup in the #DF
handler.

(Making #GP an IST exception would make the msr_safe functions unsafe
in NMI/MC context, and quite possibly have other effects.)

Special thanks to:

- Andy Lutomirski, for the suggestion of using very small stack slots
  and copy (as opposed to map) the IRET frame there, and for the
  suggestion to mark them readonly and let the fault promote to #DF.
- Konrad Wilk for paravirt fixup and testing.
- Borislav Petkov for testing help and useful comments.

Reported-by: default avatarBrian Gerst <brgerst@gmail.com>
Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
Link: http://lkml.kernel.org/r/1398816946-3351-1-git-send-email-hpa@linux.intel.com
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andrew Lutomriski <amluto@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Dirk Hohndel <dirk@hohndel.org>
Cc: Arjan van de Ven <arjan.van.de.ven@intel.com>
Cc: comex <comexk@gmail.com>
Cc: Alexander van Heukelum <heukelum@fastmail.fm>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <stable@vger.kernel.org> # consider after upstream merge
parent d1db0eea

Documentation/x86/x86_64/mm.txt

+2 −0
Original line number Diff line number Diff line
@@ -12,6 +12,8 @@ ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space 
ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole

ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB)

... unused hole ...

ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks

... unused hole ...

ffffffff80000000 - ffffffffa0000000 (=512 MB)  kernel text mapping, from phys 0

ffffffffa0000000 - ffffffffff5fffff (=1525 MB) module mapping space

ffffffffff600000 - ffffffffffdfffff (=8 MB) vsyscalls

arch/x86/include/asm/pgtable_64_types.h

+2 −0
Original line number Diff line number Diff line
@@ -61,6 +61,8 @@ typedef struct { pteval_t pte; } pte_t; 
#define MODULES_VADDR    (__START_KERNEL_map + KERNEL_IMAGE_SIZE)

#define MODULES_END      _AC(0xffffffffff000000, UL)

#define MODULES_LEN   (MODULES_END - MODULES_VADDR)

#define ESPFIX_PGD_ENTRY _AC(-2, UL)

#define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << PGDIR_SHIFT)



#define EARLY_DYNAMIC_PAGE_TABLES	64

arch/x86/include/asm/setup.h

+3 −0
Original line number Diff line number Diff line
@@ -57,6 +57,9 @@ extern void x86_ce4100_early_setup(void); 
static inline void x86_ce4100_early_setup(void) { }

#endif



extern void init_espfix_bsp(void);

extern void init_espfix_ap(void);



#ifndef _SETUP



/*

arch/x86/kernel/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ obj-$(CONFIG_X86_64) += sys_x86_64.o x8664_ksyms_64.o 
obj-y			+= syscall_$(BITS).o vsyscall_gtod.o

obj-$(CONFIG_X86_64)	+= vsyscall_64.o

obj-$(CONFIG_X86_64)	+= vsyscall_emu_64.o

obj-$(CONFIG_X86_64)	+= espfix_64.o

obj-$(CONFIG_SYSFS)	+= ksysfs.o

obj-y			+= bootflag.o e820.o

obj-y			+= pci-dma.o quirks.o topology.o kdebugfs.o

arch/x86/kernel/entry_64.S

+69 −4
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ 
#include <asm/asm.h>

#include <asm/context_tracking.h>

#include <asm/smap.h>

#include <asm/pgtable_types.h>

#include <linux/err.h>



/* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
@@ -1040,8 +1041,16 @@ restore_args: 
	RESTORE_ARGS 1,8,1



irq_return:

	/*

	 * Are we returning to a stack segment from the LDT?  Note: in

	 * 64-bit mode SS:RSP on the exception stack is always valid.

	 */

	testb $4,(SS-RIP)(%rsp)

	jnz irq_return_ldt



irq_return_iret:

	INTERRUPT_RETURN

	_ASM_EXTABLE(irq_return, bad_iret)

	_ASM_EXTABLE(irq_return_iret, bad_iret)



#ifdef CONFIG_PARAVIRT

ENTRY(native_iret)
@@ -1049,6 +1058,30 @@ ENTRY(native_iret) 
	_ASM_EXTABLE(native_iret, bad_iret)

#endif



irq_return_ldt:

	pushq_cfi %rax

	pushq_cfi %rdi

	SWAPGS

	movq PER_CPU_VAR(espfix_waddr),%rdi

	movq %rax,(0*8)(%rdi)	/* RAX */

	movq (2*8)(%rsp),%rax	/* RIP */

	movq %rax,(1*8)(%rdi)

	movq (3*8)(%rsp),%rax	/* CS */

	movq %rax,(2*8)(%rdi)

	movq (4*8)(%rsp),%rax	/* RFLAGS */

	movq %rax,(3*8)(%rdi)

	movq (6*8)(%rsp),%rax	/* SS */

	movq %rax,(5*8)(%rdi)

	movq (5*8)(%rsp),%rax	/* RSP */

	movq %rax,(4*8)(%rdi)

	andl $0xffff0000,%eax

	popq_cfi %rdi

	orq PER_CPU_VAR(espfix_stack),%rax

	SWAPGS

	movq %rax,%rsp

	popq_cfi %rax

	jmp irq_return_iret



	.section .fixup,"ax"

bad_iret:

	/*
@@ -1110,9 +1143,41 @@ ENTRY(retint_kernel) 
	call preempt_schedule_irq

	jmp exit_intr

#endif



	CFI_ENDPROC

END(common_interrupt)



	/*

	 * If IRET takes a fault on the espfix stack, then we

	 * end up promoting it to a doublefault.  In that case,

	 * modify the stack to make it look like we just entered

	 * the #GP handler from user space, similar to bad_iret.

	 */

	ALIGN

__do_double_fault:

	XCPT_FRAME 1 RDI+8

	movq RSP(%rdi),%rax		/* Trap on the espfix stack? */

	sarq $PGDIR_SHIFT,%rax

	cmpl $ESPFIX_PGD_ENTRY,%eax

	jne do_double_fault		/* No, just deliver the fault */

	cmpl $__KERNEL_CS,CS(%rdi)

	jne do_double_fault

	movq RIP(%rdi),%rax

	cmpq $irq_return_iret,%rax

#ifdef CONFIG_PARAVIRT

	je 1f

	cmpq $native_iret,%rax

#endif

	jne do_double_fault		/* This shouldn't happen... */

1:

	movq PER_CPU_VAR(kernel_stack),%rax

	subq $(6*8-KERNEL_STACK_OFFSET),%rax	/* Reset to original stack */

	movq %rax,RSP(%rdi)

	movq $0,(%rax)			/* Missing (lost) #GP error code */

	movq $general_protection,RIP(%rdi)

	retq

	CFI_ENDPROC

END(__do_double_fault)



/*

 * End of kprobes section

 */
@@ -1314,7 +1379,7 @@ zeroentry overflow do_overflow 
zeroentry bounds do_bounds

zeroentry invalid_op do_invalid_op

zeroentry device_not_available do_device_not_available

paranoiderrorentry double_fault do_double_fault

paranoiderrorentry double_fault __do_double_fault

zeroentry coprocessor_segment_overrun do_coprocessor_segment_overrun

errorentry invalid_TSS do_invalid_TSS

errorentry segment_not_present do_segment_not_present
@@ -1601,7 +1666,7 @@ error_sti: 
 */

error_kernelspace:

	incl %ebx

	leaq irq_return(%rip),%rcx

	leaq irq_return_iret(%rip),%rcx

	cmpq %rcx,RIP+8(%rsp)

	je error_swapgs

	movl %ecx,%eax	/* zero extend */

CRA Git | Maintained and supported by SUSTech CRA and CCSE