On Mon, Jul 23, 2018 at 12:25 AM, Greg KH <[email protected]> wrote: > On Sun, Jul 22, 2018 at 11:05:09AM -0700, Andy Lutomirski wrote: >> error_entry and error_exit communicate the user vs kernel status of >> the frame using %ebx. This is unnecessary -- the information is in >> regs->cs. Just use regs->cs. >> >> This makes error_entry simpler and makes error_exit more robust. >> >> It also fixes a nasty bug. Before all the Spectre nonsense, The >> xen_failsafe_callback entry point returned like this: >> >> ALLOC_PT_GPREGS_ON_STACK >> SAVE_C_REGS >> SAVE_EXTRA_REGS >> ENCODE_FRAME_POINTER >> jmp error_exit >> >> And it did not go through error_entry. This was bogus: RBX >> contained garbage, and error_exit expected a flag in RBX. >> Fortunately, it generally contained *nonzero* garbage, so the >> correct code path was used. As part of the Spectre fixes, code was >> added to clear RBX to mitigate certain speculation attacks. Now, >> depending on kernel configuration, RBX got zeroed and, when running >> some Wine workloads, the kernel crashes. This was introduced by: >> >> commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for >> exceptions/interrupts, to reduce speculation attack surface") >> >> With this patch applied, RBX is no longer needed as a flag, and the >> problem goes away. >> >> I suspect that malicious userspace could use this bug to crash the >> kernel even without the offending patch applied, though. >> >> [Historical note: I wrote this patch as a cleanup before I was aware >> of the bug it fixed.] >> >> [Note to stable maintainers: this should probably get applied to all >> kernels. If you're nervous about that, a more conservative fix to >> add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should >> also fix the problem.] >> >> Cc: Brian Gerst <[email protected]> >> Cc: Borislav Petkov <[email protected]> >> Cc: Dominik Brodowski <[email protected]> >> Cc: Ingo Molnar <[email protected]> >> Cc: "H. Peter Anvin" <[email protected]> >> Cc: Thomas Gleixner <[email protected]> >> Cc: Boris Ostrovsky <[email protected]> >> Cc: Juergen Gross <[email protected]> >> Cc: [email protected] >> Cc: [email protected] >> Cc: [email protected] >> Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for >> exceptions/interrupts, to reduce speculation attack surface") >> Reported-and-tested-by: "M. Vefa Bicakci" <[email protected]> >> Signed-off-by: Andy Lutomirski <[email protected]> >> --- >> >> I could also submit the conservative fix tagged for -stable and respin >> this on top of it. Ingo, Greg, what do you prefer? > > I don't care, this patch looks good to me to take as-is for the stable > trees. If you trust it in Linus's tree, it should be fine for others :) >
My concern is more that something may work differently in older kernels and there might be some subtle issue. I'd be surprised, but still. _______________________________________________ Xen-devel mailing list [email protected] https://lists.xenproject.org/mailman/listinfo/xen-devel
