linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Andy Lutomirski <luto@amacapital.net>,
	torvalds@linux-foundation.org,
	Thomas Gleixner <tglx@linutronix.de>
Subject: [PATCH 3.10 19/32] x86, tls, ldt: Stop checking lm in LDT_empty
Date: Tue, 27 Jan 2015 17:26:49 -0800	[thread overview]
Message-ID: <20150128012629.890226663@linuxfoundation.org> (raw)
In-Reply-To: <20150128012627.081285723@linuxfoundation.org>

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <luto@amacapital.net>

commit e30ab185c490e9a9381385529e0fd32f0a399495 upstream.

32-bit programs don't have an lm bit in their ABI, so they can't
reliably cause LDT_empty to return true without resorting to memset.
They shouldn't need to do this.

This should fix a longstanding, if minor, issue in all 64-bit kernels
as well as a potential regression in the TLS hardening code.

Fixes: 41bdc78544b8 x86/tls: Validate TLS entries to protect espfix
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Cc: torvalds@linux-foundation.org
Link: http://lkml.kernel.org/r/72a059de55e86ad5e2935c80aa91880ddf19d07c.1421954363.git.luto@amacapital.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/include/asm/desc.h |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -251,7 +251,8 @@ static inline void native_load_tls(struc
 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
 }
 
-#define _LDT_empty(info)				\
+/* This intentionally ignores lm, since 32-bit apps don't have that field. */
+#define LDT_empty(info)					\
 	((info)->base_addr		== 0	&&	\
 	 (info)->limit			== 0	&&	\
 	 (info)->contents		== 0	&&	\
@@ -261,12 +262,6 @@ static inline void native_load_tls(struc
 	 (info)->seg_not_present	== 1	&&	\
 	 (info)->useable		== 0)
 
-#ifdef CONFIG_X86_64
-#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0))
-#else
-#define LDT_empty(info) (_LDT_empty(info))
-#endif
-
 static inline void clear_LDT(void)
 {
 	set_ldt(NULL, 0);



  parent reply	other threads:[~2015-01-28  2:17 UTC|newest]

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-01-28  1:26 [PATCH 3.10 00/32] 3.10.67-stable review Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 01/32] gpio: sysfs: fix gpio-chip device-attribute leak Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 02/32] gpio: sysfs: fix gpio " Greg Kroah-Hartman
2015-01-28 16:05   ` [PATCH v2] " Johan Hovold
2015-01-28 17:42     ` Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 03/32] pinctrl: Fix two deadlocks Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 04/32] libata: prevent HSM state change race between ISR and PIO Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 05/32] ALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210 Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 06/32] scripts/recordmcount.pl: There is no -m32 gcc option on Super-H anymore Greg Kroah-Hartman
2015-01-28  1:32   ` John Paul Adrian Glaubitz
2015-01-28  2:12     ` Steven Rostedt
2015-01-28  1:26 ` [PATCH 3.10 07/32] drm/i915: Fix mutex->owner inspection race under DEBUG_MUTEXES Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 08/32] ipr: wait for aborted command responses Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 09/32] dm cache: share cache-metadata object across inactive and active DM tables Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 10/32] time: settimeofday: Validate the values of tv from user Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 11/32] time: adjtimex: Validate the ADJ_FREQUENCY values Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 12/32] ARM: dts: imx25: Fix PWM "per" clocks Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 13/32] bus: mvebu-mbus: fix support of MBus window 13 Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 14/32] can: dev: fix crtlmode_supported check Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 15/32] clocksource: exynos_mct: Fix bitmask regression for exynos4_mct_write Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 16/32] x86, hyperv: Mark the Hyper-V clocksource as being continuous Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 17/32] x86/tsc: Change Fast TSC calibration failed from error to info Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 18/32] KVM: x86: Fix of previously incomplete fix for CVE-2014-8480 Greg Kroah-Hartman
2015-01-28  1:26 ` Greg Kroah-Hartman [this message]
2015-01-28  1:26 ` [PATCH 3.10 20/32] x86, tls: Interpret an all-zero struct user_desc as "no segment" Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 21/32] x86/asm/traps: Disable tracing and kprobes in fixup_bad_iret and sync_regs Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 22/32] sata_dwc_460ex: fix resource leak on error path Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 23/32] KEYS: close race between key lookup and freeing Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 24/32] ipvs: uninitialized data with IP_VS_IPV6 Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 25/32] Revert "swiotlb-xen: pass dev_addr to swiotlb_tbl_unmap_single" Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 26/32] drbd: merge_bvec_fn: properly remap bvm->bi_bdev Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 27/32] crypto: prefix module autoloading with "crypto-" Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 28/32] crypto: include crypto- module prefix in template Greg Kroah-Hartman
2015-01-28  1:26 ` [PATCH 3.10 29/32] crypto: add missing crypto module aliases Greg Kroah-Hartman
2015-01-28  1:27 ` [PATCH 3.10 30/32] quota: provide interface for readding allocated space into reserved space Greg Kroah-Hartman
2015-01-28  1:27 ` [PATCH 3.10 31/32] ext4: fix warning in ext4_da_update_reserve_space() Greg Kroah-Hartman
2015-01-28  1:27 ` [PATCH 3.10 32/32] md/raid5: fetch_block must fetch all the blocks handle_stripe_dirtying wants Greg Kroah-Hartman
2015-01-28 14:14 ` [PATCH 3.10 00/32] 3.10.67-stable review Guenter Roeck
2015-01-28 16:51 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150128012629.890226663@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).