Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 658fdbef authored by Andi Kleen's avatar Andi Kleen Committed by Andi Kleen
Browse files

[PATCH] Don't leak NT bit into next task 



SYSENTER can cause a NT to be set which might cause crashes on the IRET
in the next task.

Following similar i386 patch from Linus.

Signed-off-by: default avatarAndi Kleen <ak@suse.de>
parent adf14236

arch/x86_64/kernel/entry.S

+4 −0
Original line number Diff line number Diff line
@@ -155,6 +155,10 @@ 
/* rdi:	prev */	

ENTRY(ret_from_fork)

	CFI_DEFAULT_STACK

	push kernel_eflags(%rip)

	CFI_ADJUST_CFA_OFFSET 4

	popf				# reset kernel eflags

	CFI_ADJUST_CFA_OFFSET -4

	call schedule_tail

	GET_THREAD_INFO(%rcx)

	testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT),threadinfo_flags(%rcx)

arch/x86_64/kernel/setup64.c

+4 −0
Original line number Diff line number Diff line
@@ -180,6 +180,8 @@ void __cpuinit check_efer(void) 
        }       

}



unsigned long kernel_eflags;



/*

 * cpu_init() initializes state that is per-CPU. Some data is already

 * initialized (naturally) in the bootstrap process, such as the GDT
@@ -281,4 +283,6 @@ void __cpuinit cpu_init (void) 
	set_debugreg(0UL, 7);



	fpu_init(); 



	raw_local_save_flags(kernel_eflags);

}

include/asm-x86_64/system.h

+3 −2
Original line number Diff line number Diff line
@@ -14,12 +14,13 @@ 
#define __RESTORE(reg,offset) "movq (14-" #offset ")*8(%%rsp),%%" #reg "\n\t"



/* frame pointer must be last for get_wchan */

#define SAVE_CONTEXT    "pushq %%rbp ; movq %%rsi,%%rbp\n\t"

#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp\n\t"

#define SAVE_CONTEXT    "pushf ; pushq %%rbp ; movq %%rsi,%%rbp\n\t"

#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp ; popf\t"



#define __EXTRA_CLOBBER  \

	,"rcx","rbx","rdx","r8","r9","r10","r11","r12","r13","r14","r15"



/* Save restore flags to clear handle leaking NT */

#define switch_to(prev,next,last) \

	asm volatile(SAVE_CONTEXT						    \

		     "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */	  \