On 03/06/2018, 03:21 PM, Jiri Slaby wrote:
> On 02/23/2018, 07:26 PM, Greg Kroah-Hartman wrote:
>> 4.4-stable review patch. If anyone has any objections, please let me know.
>>
>> ------------------
>>
>> From: Dan Williams <[email protected]>
>>
>> (cherry picked from commit 2fbd7af5af8665d18bcefae3e9700be07e22b681)
>>
>> The syscall table base is a user controlled function pointer in kernel
>> space. Use array_index_nospec() to prevent any out of bounds speculation.
>>
>> While retpoline prevents speculating into a userspace directed target it
>> does not stop the pointer de-reference, the concern is leaking memory
>> relative to the syscall table base, by observing instruction cache
>> behavior.
>>
>> Reported-by: Linus Torvalds <[email protected]>
>> Signed-off-by: Dan Williams <[email protected]>
>> Signed-off-by: Thomas Gleixner <[email protected]>
>> Cc: [email protected]
>> Cc: [email protected]
>> Cc: [email protected]
>> Cc: Andy Lutomirski <[email protected]>
>> Cc: [email protected]
>> Link:
>> https://lkml.kernel.org/r/151727417984.33451.1216731042505722161.st...@dwillia2-desk3.amr.corp.intel.com
>> Signed-off-by: David Woodhouse <[email protected]>
>> [jwang: port to 4.4, no syscall_64]
>
> This is not complete IMO, the syscall is indeed there, only written in
> assembly in 4.4 yet.
>
> So this patch looks like it is missing these two hunks (from my
> SLE12-SP2 backport):
>
>> --- a/arch/x86/entry/entry_64.S
>> +++ b/arch/x86/entry/entry_64.S
>> @@ -184,6 +184,8 @@ entry_SYSCALL_64_fastpath:
>> cmpl $__NR_syscall_max, %eax
>> #endif
>> ja 1f /* return -ENOSYS (already in
>> pt_regs->ax) */
>> + sbb %rcx, %rcx /* array_index_mask_nospec()
>> */
>> + and %rcx, %rax
Which is not completely correct either. The preceding comparison should
write:
cmpl $NR_syscalls, %eax
jae 1f
to have sbb correctly working even on the last syscall number.
thanks,
--
js
suse labs
