From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Andy Lutomirski <luto@amacapital.net>,
torvalds@linux-foundation.org,
Thomas Gleixner <tglx@linutronix.de>
Subject: [PATCH 3.10 19/32] x86, tls, ldt: Stop checking lm in LDT_empty
Date: Tue, 27 Jan 2015 17:26:49 -0800 [thread overview]
Message-ID: <20150128012629.890226663@linuxfoundation.org> (raw)
In-Reply-To: <20150128012627.081285723@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@amacapital.net>
commit e30ab185c490e9a9381385529e0fd32f0a399495 upstream.
32-bit programs don't have an lm bit in their ABI, so they can't
reliably cause LDT_empty to return true without resorting to memset.
They shouldn't need to do this.
This should fix a longstanding, if minor, issue in all 64-bit kernels
as well as a potential regression in the TLS hardening code.
Fixes: 41bdc78544b8 x86/tls: Validate TLS entries to protect espfix
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Cc: torvalds@linux-foundation.org
Link: http://lkml.kernel.org/r/72a059de55e86ad5e2935c80aa91880ddf19d07c.1421954363.git.luto@amacapital.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/desc.h | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
--- a/arch/x86/include/asm/desc.h
+++ b/arch/x86/include/asm/desc.h
@@ -251,7 +251,8 @@ static inline void native_load_tls(struc
gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
}
-#define _LDT_empty(info) \
+/* This intentionally ignores lm, since 32-bit apps don't have that field. */
+#define LDT_empty(info) \
((info)->base_addr == 0 && \
(info)->limit == 0 && \
(info)->contents == 0 && \
@@ -261,12 +262,6 @@ static inline void native_load_tls(struc
(info)->seg_not_present == 1 && \
(info)->useable == 0)
-#ifdef CONFIG_X86_64
-#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0))
-#else
-#define LDT_empty(info) (_LDT_empty(info))
-#endif
-
static inline void clear_LDT(void)
{
set_ldt(NULL, 0);
next prev parent reply other threads:[~2015-01-28 2:17 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-28 1:26 [PATCH 3.10 00/32] 3.10.67-stable review Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 01/32] gpio: sysfs: fix gpio-chip device-attribute leak Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 02/32] gpio: sysfs: fix gpio " Greg Kroah-Hartman
2015-01-28 16:05 ` [PATCH v2] " Johan Hovold
2015-01-28 17:42 ` Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 03/32] pinctrl: Fix two deadlocks Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 04/32] libata: prevent HSM state change race between ISR and PIO Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 05/32] ALSA: usb-audio: Add mic volume fix quirk for Logitech Webcam C210 Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 06/32] scripts/recordmcount.pl: There is no -m32 gcc option on Super-H anymore Greg Kroah-Hartman
2015-01-28 1:32 ` John Paul Adrian Glaubitz
2015-01-28 2:12 ` Steven Rostedt
2015-01-28 1:26 ` [PATCH 3.10 07/32] drm/i915: Fix mutex->owner inspection race under DEBUG_MUTEXES Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 08/32] ipr: wait for aborted command responses Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 09/32] dm cache: share cache-metadata object across inactive and active DM tables Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 10/32] time: settimeofday: Validate the values of tv from user Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 11/32] time: adjtimex: Validate the ADJ_FREQUENCY values Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 12/32] ARM: dts: imx25: Fix PWM "per" clocks Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 13/32] bus: mvebu-mbus: fix support of MBus window 13 Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 14/32] can: dev: fix crtlmode_supported check Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 15/32] clocksource: exynos_mct: Fix bitmask regression for exynos4_mct_write Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 16/32] x86, hyperv: Mark the Hyper-V clocksource as being continuous Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 17/32] x86/tsc: Change Fast TSC calibration failed from error to info Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 18/32] KVM: x86: Fix of previously incomplete fix for CVE-2014-8480 Greg Kroah-Hartman
2015-01-28 1:26 ` Greg Kroah-Hartman [this message]
2015-01-28 1:26 ` [PATCH 3.10 20/32] x86, tls: Interpret an all-zero struct user_desc as "no segment" Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 21/32] x86/asm/traps: Disable tracing and kprobes in fixup_bad_iret and sync_regs Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 22/32] sata_dwc_460ex: fix resource leak on error path Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 23/32] KEYS: close race between key lookup and freeing Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 24/32] ipvs: uninitialized data with IP_VS_IPV6 Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 25/32] Revert "swiotlb-xen: pass dev_addr to swiotlb_tbl_unmap_single" Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 26/32] drbd: merge_bvec_fn: properly remap bvm->bi_bdev Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 27/32] crypto: prefix module autoloading with "crypto-" Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 28/32] crypto: include crypto- module prefix in template Greg Kroah-Hartman
2015-01-28 1:26 ` [PATCH 3.10 29/32] crypto: add missing crypto module aliases Greg Kroah-Hartman
2015-01-28 1:27 ` [PATCH 3.10 30/32] quota: provide interface for readding allocated space into reserved space Greg Kroah-Hartman
2015-01-28 1:27 ` [PATCH 3.10 31/32] ext4: fix warning in ext4_da_update_reserve_space() Greg Kroah-Hartman
2015-01-28 1:27 ` [PATCH 3.10 32/32] md/raid5: fetch_block must fetch all the blocks handle_stripe_dirtying wants Greg Kroah-Hartman
2015-01-28 14:14 ` [PATCH 3.10 00/32] 3.10.67-stable review Guenter Roeck
2015-01-28 16:51 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150128012629.890226663@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).