Author: kib
Date: Tue Feb 5 17:49:27 2019
New Revision: 343780
URL: https://svnweb.freebsd.org/changeset/base/343780
Log:
amd64: clear callee-preserved registers on syscall exit.
%r8, %r10, and on non-KPTI configuration %r9 were not restored on fast
return from a syscall.
Reviewed by: markj
Approved by: so
Security: CVE-2019-5595
Sponsored by: The FreeBSD Foundation
MFC after: 0 minutes
Modified:
head/sys/amd64/amd64/exception.S
Modified: head/sys/amd64/amd64/exception.S
==============================================================================
--- head/sys/amd64/amd64/exception.S Tue Feb 5 17:17:12 2019
(r343779)
+++ head/sys/amd64/amd64/exception.S Tue Feb 5 17:49:27 2019
(r343780)
@@ -521,12 +521,14 @@ fast_syscall_common:
movq TF_RFLAGS(%rsp),%r11 /* original %rflags */
movq TF_RIP(%rsp),%rcx /* original %rip */
movq TF_RSP(%rsp),%rsp /* user stack pointer */
+ xorl %r8d,%r8d /* zero the rest of GPRs */
+ xorl %r10d,%r10d
cmpq $~0,PCPU(UCR3)
je 2f
movq PCPU(UCR3),%r9
movq %r9,%cr3
- xorl %r9d,%r9d
-2: swapgs
+2: xorl %r9d,%r9d
+ swapgs
sysretq
3: /* AST scheduled. */
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
