From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Lai Jiangshan <jiangshan.ljs@antgroup.com>,
Borislav Petkov <bp@suse.de>,
Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Subject: [PATCH 5.15 02/78] x86/entry: Switch the stack after error_entry() returns
Date: Tue, 12 Jul 2022 20:38:32 +0200 [thread overview]
Message-ID: <20220712183238.937020352@linuxfoundation.org> (raw)
In-Reply-To: <20220712183238.844813653@linuxfoundation.org>
From: Lai Jiangshan <jiangshan.ljs@antgroup.com>
commit 520a7e80c96d655fbe4650d9cc985bd9d0443389 upstream.
error_entry() calls fixup_bad_iret() before sync_regs() if it is a fault
from a bad IRET, to copy pt_regs to the kernel stack. It switches to the
kernel stack directly after sync_regs().
But error_entry() itself is also a function call, so it has to stash
the address it is going to return to, in %r12 which is unnecessarily
complicated.
Move the stack switching after error_entry() and get rid of the need to
handle the return address.
[ bp: Massage commit message. ]
Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lore.kernel.org/r/20220503032107.680190-3-jiangshanlai@gmail.com
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/entry/entry_64.S | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -323,6 +323,8 @@ SYM_CODE_END(ret_from_fork)
.macro idtentry_body cfunc has_error_code:req
call error_entry
+ movq %rax, %rsp /* switch to the task stack if from userspace */
+ ENCODE_FRAME_POINTER
UNWIND_HINT_REGS
movq %rsp, %rdi /* pt_regs pointer into 1st argument*/
@@ -982,14 +984,10 @@ SYM_CODE_START_LOCAL(error_entry)
/* We have user CR3. Change to kernel CR3. */
SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
+ leaq 8(%rsp), %rdi /* arg0 = pt_regs pointer */
.Lerror_entry_from_usermode_after_swapgs:
/* Put us onto the real thread stack. */
- popq %r12 /* save return addr in %12 */
- movq %rsp, %rdi /* arg0 = pt_regs pointer */
call sync_regs
- movq %rax, %rsp /* switch stack */
- ENCODE_FRAME_POINTER
- pushq %r12
RET
/*
@@ -1021,6 +1019,7 @@ SYM_CODE_START_LOCAL(error_entry)
*/
.Lerror_entry_done_lfence:
FENCE_SWAPGS_KERNEL_ENTRY
+ leaq 8(%rsp), %rax /* return pt_regs pointer */
RET
.Lbstep_iret:
@@ -1041,12 +1040,9 @@ SYM_CODE_START_LOCAL(error_entry)
* Pretend that the exception came from user mode: set up pt_regs
* as if we faulted immediately after IRET.
*/
- popq %r12 /* save return addr in %12 */
- movq %rsp, %rdi /* arg0 = pt_regs pointer */
+ leaq 8(%rsp), %rdi /* arg0 = pt_regs pointer */
call fixup_bad_iret
- mov %rax, %rsp
- ENCODE_FRAME_POINTER
- pushq %r12
+ mov %rax, %rdi
jmp .Lerror_entry_from_usermode_after_swapgs
SYM_CODE_END(error_entry)
next prev parent reply other threads:[~2022-07-12 18:58 UTC|newest]
Thread overview: 107+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-12 18:38 [PATCH 5.15 00/78] 5.15.55-rc1 review Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 01/78] x86/traps: Use pt_regs directly in fixup_bad_iret() Greg Kroah-Hartman
2022-07-12 18:38 ` Greg Kroah-Hartman [this message]
2022-07-12 18:38 ` [PATCH 5.15 03/78] x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry() Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 04/78] x86/entry: Dont call error_entry() for XENPV Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 05/78] objtool: Classify symbols Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 06/78] objtool: Explicitly avoid self modifying code in .altinstr_replacement Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 07/78] objtool: Shrink struct instruction Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 08/78] objtool,x86: Replace alternatives with .retpoline_sites Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 09/78] objtool: Introduce CFI hash Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 10/78] x86/retpoline: Remove unused replacement symbols Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 11/78] x86/asm: Fix register order Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 12/78] x86/asm: Fixup odd GEN-for-each-reg.h usage Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 13/78] x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 14/78] x86/retpoline: Create a retpoline thunk array Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 15/78] x86/alternative: Implement .retpoline_sites support Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 16/78] x86/alternative: Handle Jcc __x86_indirect_thunk_\reg Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 17/78] x86/alternative: Try inline spectre_v2=retpoline,amd Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 18/78] x86/alternative: Add debug prints to apply_retpolines() Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 19/78] bpf,x86: Simplify computing label offsets Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 20/78] bpf,x86: Respect X86_FEATURE_RETPOLINE* Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 21/78] objtool: Default ignore INT3 for unreachable Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 22/78] x86/entry: Remove skip_r11rcx Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 23/78] x86/realmode: build with -D__DISABLE_EXPORTS Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 24/78] x86/kvm/vmx: Make noinstr clean Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 25/78] x86/cpufeatures: Move RETPOLINE flags to word 11 Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 26/78] x86/retpoline: Cleanup some #ifdefery Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 27/78] x86/retpoline: Swizzle retpoline thunk Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 28/78] x86/retpoline: Use -mfunction-return Greg Kroah-Hartman
2022-07-12 18:38 ` [PATCH 5.15 29/78] x86: Undo return-thunk damage Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 30/78] x86,objtool: Create .return_sites Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 31/78] objtool: skip non-text sections when adding return-thunk sites Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 32/78] x86,static_call: Use alternative RET encoding Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 33/78] x86/ftrace: " Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 34/78] x86/bpf: " Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 35/78] x86/kvm: Fix SETcc emulation for return thunks Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 36/78] x86/vsyscall_emu/64: Dont use RET in vsyscall emulation Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 37/78] x86/sev: Avoid using __x86_return_thunk Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 38/78] x86: Use return-thunk in asm code Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 39/78] x86/entry: Avoid very early RET Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 40/78] objtool: Treat .text.__x86.* as noinstr Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 41/78] x86: Add magic AMD return-thunk Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 42/78] x86/bugs: Report AMD retbleed vulnerability Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 43/78] x86/bugs: Add AMD retbleed= boot parameter Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 44/78] x86/bugs: Enable STIBP for JMP2RET Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 45/78] x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 46/78] x86/entry: Add kernel IBRS implementation Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 47/78] x86/bugs: Optimize SPEC_CTRL MSR writes Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 48/78] x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 49/78] x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 50/78] x86/bugs: Report Intel retbleed vulnerability Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 51/78] intel_idle: Disable IBRS during long idle Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 52/78] objtool: Update Retpoline validation Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 53/78] x86/xen: Rename SYS* entry points Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 54/78] x86/xen: Add UNTRAIN_RET Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 55/78] x86/bugs: Add retbleed=ibpb Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 56/78] x86/bugs: Do IBPB fallback check only once Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 57/78] objtool: Add entry UNRET validation Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 58/78] x86/cpu/amd: Add Spectral Chicken Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 59/78] x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 60/78] x86/speculation: Fix firmware entry SPEC_CTRL handling Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 61/78] x86/speculation: Fix SPEC_CTRL write on SMT state change Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 62/78] x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 63/78] x86/speculation: Remove x86_spec_ctrl_mask Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 64/78] objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 65/78] KVM: VMX: Flatten __vmx_vcpu_run() Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 66/78] KVM: VMX: Convert launched argument to flags Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 67/78] KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 68/78] KVM: VMX: Fix IBRS handling after vmexit Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 69/78] x86/speculation: Fill RSB on vmexit for IBRS Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 70/78] x86/common: Stamp out the stepping madness Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 71/78] x86/cpu/amd: Enumerate BTC_NO Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 72/78] x86/retbleed: Add fine grained Kconfig knobs Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 73/78] x86/bugs: Add Cannon lake to RETBleed affected CPU list Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 74/78] x86/entry: Move PUSH_AND_CLEAR_REGS() back into error_entry Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 75/78] x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 76/78] x86/kexec: Disable RET on kexec Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 77/78] x86/speculation: Disable RRSBA behavior Greg Kroah-Hartman
2022-07-12 18:39 ` [PATCH 5.15 78/78] x86/static_call: Serialize __static_call_fixup() properly Greg Kroah-Hartman
2022-07-12 23:25 ` [PATCH 5.15 00/78] 5.15.55-rc1 review Florian Fainelli
2022-07-13 3:19 ` Shuah Khan
2022-07-13 3:25 ` Bagas Sanjaya
2022-07-13 7:17 ` Jon Hunter
2022-07-13 10:09 ` Sudip Mukherjee (Codethink)
2022-07-13 12:52 ` Naresh Kamboju
2022-07-13 13:34 ` Guenter Roeck
2022-07-13 18:33 ` Linus Torvalds
2022-07-13 18:40 ` Linus Torvalds
2022-07-14 9:01 ` Borislav Petkov
2022-07-14 13:46 ` Paolo Bonzini
2022-07-14 14:46 ` Boris Petkov
2022-07-14 17:02 ` Linus Torvalds
2022-07-14 17:12 ` Paolo Bonzini
2022-07-14 17:22 ` Peter Zijlstra
2022-07-14 18:00 ` Linus Torvalds
2022-07-14 18:16 ` Linus Torvalds
2022-07-14 19:26 ` Boris Petkov
2022-07-15 11:35 ` Paolo Bonzini
2022-07-14 16:51 ` Linus Torvalds
2022-07-14 17:00 ` Borislav Petkov
2022-07-14 20:39 ` Linus Torvalds
2022-07-15 14:03 ` Borislav Petkov
2022-07-14 9:50 ` Maxim Levitsky
2022-07-14 10:04 ` Greg Kroah-Hartman
2022-07-14 10:59 ` Maxim Levitsky
2022-07-13 16:41 ` Ron Economos
2022-07-13 22:18 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220712183238.937020352@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bp@suse.de \
--cc=cascardo@canonical.com \
--cc=jiangshan.ljs@antgroup.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).