After a page fault from userland, the kernel is entered and it switches the stack to the PTI stack which is mapped both in the kernel and in the user page-table. When executing the page fault handler, switch to the kernel stack (which is mapped only in the kernel page-table) so that no kernel data leak to the userland through the stack.
Signed-off-by: Alexandre Chartre <alexandre.char...@oracle.com> --- arch/x86/include/asm/idtentry.h | 17 +++++++++++++++++ arch/x86/mm/fault.c | 2 +- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/idtentry.h b/arch/x86/include/asm/idtentry.h index 0c5d9f027112..a6725afaaec0 100644 --- a/arch/x86/include/asm/idtentry.h +++ b/arch/x86/include/asm/idtentry.h @@ -31,6 +31,13 @@ void idtentry_exit_nmi(struct pt_regs *regs, bool irq_state); (void (*)(void))(func), (void *)(arg1), (void *)(arg2)) : \ func(arg1, arg2)) +#define CALL_ON_STACK_3(stack, func, arg1, arg2, arg3) \ + ((stack) ? \ + asm_call_on_stack_3(stack, \ + (void (*)(void))(func), (void *)(arg1), (void *)(arg2), \ + (void *)(arg3)) : \ + func(arg1, arg2, arg3)) + /* * Functions to return the top of the kernel stack if we are using the * user page-table (and thus not running with the kernel stack). If we @@ -66,6 +73,16 @@ void run_idt_errcode(void (*func)(struct pt_regs *, unsigned long), CALL_ON_STACK_2(pti_kernel_stack(regs), func, regs, error_code); } +static __always_inline +void run_idt_pagefault(void (*func)(struct pt_regs *, unsigned long, + unsigned long), + struct pt_regs *regs, unsigned long error_code, + unsigned long address) +{ + CALL_ON_STACK_3(pti_kernel_stack(regs), + func, regs, error_code, address); +} + static __always_inline void run_sysvec(void (*func)(struct pt_regs *regs), struct pt_regs *regs) { diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index 82bf37a5c9ec..b9d03603d95d 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -1482,7 +1482,7 @@ DEFINE_IDTENTRY_RAW_ERRORCODE(exc_page_fault) state = irqentry_enter(regs); instrumentation_begin(); - handle_page_fault(regs, error_code, address); + run_idt_pagefault(handle_page_fault, regs, error_code, address); instrumentation_end(); irqentry_exit(regs, state); -- 2.18.4