From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751851AbdKWHEO (ORCPT ); Thu, 23 Nov 2017 02:04:14 -0500 Received: from terminus.zytor.com ([65.50.211.136]:54933 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751129AbdKWHEM (ORCPT ); Thu, 23 Nov 2017 02:04:12 -0500 Date: Wed, 22 Nov 2017 22:58:36 -0800 From: tip-bot for Andy Lutomirski Message-ID: Cc: hpa@zytor.com, mingo@kernel.org, torvalds@linux-foundation.org, peterz@infradead.org, jpoimboe@redhat.com, dave.hansen@intel.com, bpetkov@suse.de, tglx@linutronix.de, brgerst@gmail.com, linux-kernel@vger.kernel.org, luto@kernel.org Reply-To: tglx@linutronix.de, brgerst@gmail.com, linux-kernel@vger.kernel.org, luto@kernel.org, hpa@zytor.com, mingo@kernel.org, jpoimboe@redhat.com, peterz@infradead.org, torvalds@linux-foundation.org, dave.hansen@intel.com, bpetkov@suse.de In-Reply-To: References: To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/urgent] x86/entry/64: Add missing irqflags tracing to native_load_gs_index() Git-Commit-ID: ca37e57bbe0cf1455ea3e84eb89ed04a132d59e1 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: ca37e57bbe0cf1455ea3e84eb89ed04a132d59e1 Gitweb: https://git.kernel.org/tip/ca37e57bbe0cf1455ea3e84eb89ed04a132d59e1 Author: Andy Lutomirski AuthorDate: Wed, 22 Nov 2017 20:39:16 -0800 Committer: Ingo Molnar CommitDate: Thu, 23 Nov 2017 07:54:25 +0100 x86/entry/64: Add missing irqflags tracing to native_load_gs_index() Running this code with IRQs enabled (where dummy_lock is a spinlock): static void check_load_gs_index(void) { /* This will fail. */ load_gs_index(0xffff); spin_lock(&dummy_lock); spin_unlock(&dummy_lock); } Will generate a lockdep warning. The issue is that the actual write to %gs would cause an exception with IRQs disabled, and the exception handler would, as an inadvertent side effect, update irqflag tracing to reflect the IRQs-off status. native_load_gs_index() would then turn IRQs back on and return with irqflag tracing still thinking that IRQs were off. The dummy lock-and-unlock causes lockdep to notice the error and warn. Fix it by adding the missing tracing. Apparently nothing did this in a context where it mattered. I haven't tried to find a code path that would actually exhibit the warning if appropriately nasty user code were running. I suspect that the security impact of this bug is very, very low -- production systems don't run with lockdep enabled, and the warning is mostly harmless anyway. Found during a quick audit of the entry code to try to track down an unrelated bug that Ingo found in some still-in-development code. Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Hansen Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/e1aeb0e6ba8dd430ec36c8a35e63b429698b4132.1511411918.git.luto@kernel.org Signed-off-by: Ingo Molnar --- arch/x86/entry/entry_64.S | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index 5063ed1..f81d50d 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -51,15 +51,19 @@ ENTRY(native_usergs_sysret64) END(native_usergs_sysret64) #endif /* CONFIG_PARAVIRT */ -.macro TRACE_IRQS_IRETQ +.macro TRACE_IRQS_FLAGS flags:req #ifdef CONFIG_TRACE_IRQFLAGS - bt $9, EFLAGS(%rsp) /* interrupts off? */ + bt $9, \flags /* interrupts off? */ jnc 1f TRACE_IRQS_ON 1: #endif .endm +.macro TRACE_IRQS_IRETQ + TRACE_IRQS_FLAGS EFLAGS(%rsp) +.endm + /* * When dynamic function tracer is enabled it will add a breakpoint * to all locations that it is about to modify, sync CPUs, update @@ -943,11 +947,13 @@ ENTRY(native_load_gs_index) FRAME_BEGIN pushfq DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI) + TRACE_IRQS_OFF SWAPGS .Lgs_change: movl %edi, %gs 2: ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE SWAPGS + TRACE_IRQS_FLAGS (%rsp) popfq FRAME_END ret