On Tue, Mar 6, 2018 at 3:21 PM, Jiri Slaby <jsl...@suse.cz> wrote: > On 02/23/2018, 07:26 PM, Greg Kroah-Hartman wrote: >> 4.4-stable review patch. If anyone has any objections, please let me know. >> >> ------------------ >> >> From: Dan Williams <dan.j.willi...@intel.com> >> >> (cherry picked from commit 2fbd7af5af8665d18bcefae3e9700be07e22b681) >> >> The syscall table base is a user controlled function pointer in kernel >> space. Use array_index_nospec() to prevent any out of bounds speculation. >> >> While retpoline prevents speculating into a userspace directed target it >> does not stop the pointer de-reference, the concern is leaking memory >> relative to the syscall table base, by observing instruction cache >> behavior. >> >> Reported-by: Linus Torvalds <torva...@linux-foundation.org> >> Signed-off-by: Dan Williams <dan.j.willi...@intel.com> >> Signed-off-by: Thomas Gleixner <t...@linutronix.de> >> Cc: linux-a...@vger.kernel.org >> Cc: kernel-harden...@lists.openwall.com >> Cc: gre...@linuxfoundation.org >> Cc: Andy Lutomirski <l...@kernel.org> >> Cc: a...@linux.intel.com >> Link: >> https://lkml.kernel.org/r/151727417984.33451.1216731042505722161.st...@dwillia2-desk3.amr.corp.intel.com >> Signed-off-by: David Woodhouse <d...@amazon.co.uk> >> [jwang: port to 4.4, no syscall_64] > > This is not complete IMO, the syscall is indeed there, only written in > assembly in 4.4 yet. > > So this patch looks like it is missing these two hunks (from my > SLE12-SP2 backport): > >> --- a/arch/x86/entry/entry_64.S >> +++ b/arch/x86/entry/entry_64.S >> @@ -184,6 +184,8 @@ entry_SYSCALL_64_fastpath: >> cmpl $__NR_syscall_max, %eax >> #endif >> ja 1f /* return -ENOSYS (already in >> pt_regs->ax) */ >> + sbb %rcx, %rcx /* array_index_mask_nospec() >> */ >> + and %rcx, %rax >> movq %r10, %rcx >> #ifdef CONFIG_RETPOLINE >> movq sys_call_table(, %rax, 8), %rax >> @@ -282,6 +284,8 @@ tracesys_phase2: >> cmpl $__NR_syscall_max, %eax >> #endif >> ja 1f /* return -ENOSYS (already in >> pt_regs->ax) */ >> + sbb %rcx, %rcx /* array_index_mask_nospec() >> */ >> + and %rcx, %rax >> movq %r10, %rcx /* fixup for C */ >> #ifdef CONFIG_RETPOLINE >> movq sys_call_table(, %rax, 8), %rax > > Discovered by Jan Beulich. > > thanks, > -- > js > suse labs
Thanks Jiri, yes, indeed, could you send a formal patch of the fix? Thanks! Jack Wang
