LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Denys Vlasenko <dvlasenk@redhat.com>
To: Borislav Petkov <bp@alien8.de>, Ingo Molnar <mingo@kernel.org>
Cc: linux-tip-commits@vger.kernel.org, linux-kernel@vger.kernel.org,
keescook@chromium.org, ast@plumgrid.com, fweisbec@gmail.com,
oleg@redhat.com, tglx@linutronix.de,
torvalds@linux-foundation.org, hpa@zytor.com, wad@chromium.org,
rostedt@goodmis.org
Subject: Re: [tip:x86/asm] x86/asm/entry/64: Remove unused thread_struct::usersp
Date: Tue, 17 Mar 2015 13:22:05 +0100 [thread overview]
Message-ID: <55081C6D.6090609@redhat.com> (raw)
In-Reply-To: <20150317073901.GC19645@pd.tnic>
On 03/17/2015 08:39 AM, Borislav Petkov wrote:
> On Tue, Mar 17, 2015 at 08:21:18AM +0100, Ingo Molnar wrote:
>> Assuming this does not fix the regression, could you apply the minimal
>> patch below - which reverts the old_rsp handling change.
>>
>> (The rest of the commit are in a third patch, but those are only
>> comment changes.)
>>
>> So my theory is that this change is what will revert the regression.
>
> Yep, it does. Below is the diff that works (it is the rough revert
> without the comments :-)):
>
...
> @@ -395,6 +398,8 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
> /*
> * Switch the PDA and FPU contexts.
> */
> + prev->usersp = this_cpu_read(old_rsp);
> + this_cpu_write(old_rsp, next->usersp);
I have a theory. There is a time window when user's sp
is in PER_CPU_VAR(old_rsp) but not yet in pt_regs->sp,
and *interrupts are enabled*:
ENTRY(system_call)
SWAPGS_UNSAFE_STACK
movq %rsp,PER_CPU_VAR(old_rsp)
movq PER_CPU_VAR(kernel_stack),%rsp
ENABLE_INTERRUPTS(CLBR_NONE)
ALLOC_PT_GPREGS_ON_STACK 8 /* +8: space for orig_ax */
movq %rcx,RIP(%rsp)
movq PER_CPU_VAR(old_rsp),%rcx
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
movq %r11,EFLAGS(%rsp)
movq %rcx,RSP(%rsp)
Before indicated insn, interrupts are already enabled.
If preempt would hit now, next task can clobber PER_CPU_VAR(old_rsp).
Then, when we return to this task, a bogus user's sp will be stored
in pt_regs, restores on exit to userspace, and next attempt
to, say, execute RETQ will try to pop a bogus, likely noncanonical
address into RIP -> #GP -> SEGV!
The theory can be tested by just moving interrupt enable a bit down:
ENTRY(system_call)
SWAPGS_UNSAFE_STACK
movq %rsp,PER_CPU_VAR(old_rsp)
movq PER_CPU_VAR(kernel_stack),%rsp
- ENABLE_INTERRUPTS(CLBR_NONE)
ALLOC_PT_GPREGS_ON_STACK 8 /* +8: space for orig_ax */
movq %rcx,RIP(%rsp)
movq PER_CPU_VAR(old_rsp),%rcx
movq %r11,EFLAGS(%rsp)
movq %rcx,RSP(%rsp)
+ ENABLE_INTERRUPTS(CLBR_NONE)
If I'm right, segfaults should be gone.
Borislav, can you try this?
next prev parent reply other threads:[~2015-03-17 12:22 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-10 10:45 [PATCH 2/4] x86: entry_64.S: remove stub_iopl Denys Vlasenko
2015-03-10 10:45 ` [PATCH 4/4] x86: entry_64.S: remove unused thread_struct::usersp Denys Vlasenko
2015-03-11 12:55 ` Borislav Petkov
2015-03-11 15:19 ` Denys Vlasenko
2015-03-16 12:05 ` [tip:x86/asm] x86/asm/entry/64: Remove unused thread_struct:: usersp tip-bot for Denys Vlasenko
2015-03-16 16:47 ` Borislav Petkov
2015-03-16 22:20 ` [tip:x86/asm] x86/asm/entry/64: Remove unused thread_struct::usersp Denys Vlasenko
2015-03-17 7:08 ` Borislav Petkov
2015-03-17 7:13 ` Ingo Molnar
2015-03-17 7:21 ` Ingo Molnar
2015-03-17 7:39 ` Borislav Petkov
2015-03-17 12:22 ` Denys Vlasenko [this message]
2015-03-17 12:51 ` Denys Vlasenko
2015-03-17 7:51 ` Ingo Molnar
2015-03-17 8:06 ` Borislav Petkov
2015-03-17 8:27 ` Ingo Molnar
2015-03-17 9:01 ` Borislav Petkov
2015-03-11 12:08 ` [PATCH 2/4] x86: entry_64.S: remove stub_iopl Borislav Petkov
2015-03-16 12:05 ` [tip:x86/asm] x86/asm/entry/64: Remove stub_iopl tip-bot for Denys Vlasenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55081C6D.6090609@redhat.com \
--to=dvlasenk@redhat.com \
--cc=ast@plumgrid.com \
--cc=bp@alien8.de \
--cc=fweisbec@gmail.com \
--cc=hpa@zytor.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tip-commits@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=oleg@redhat.com \
--cc=rostedt@goodmis.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=wad@chromium.org \
--subject='Re: [tip:x86/asm] x86/asm/entry/64: Remove unused thread_struct::usersp' \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).