[tip:x86/pti] x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()

[tip-bot for Dianzhang Chen]

Commit-ID:  31a2fbb390fee4231281b939e1979e810f945415
Gitweb: https://git.kernel.org/tip/31a2fbb390fee4231281b939e1979e810f945415
Author: Dianzhang Chen 
AuthorDate: Tue, 25 Jun 2019 23:30:17 +0800
Committer:  Thomas Gleixner 
CommitDate: Thu, 27 Jun 2019 23:48:04 +0200

x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()

The index to access the threads ptrace_bps is controlled by userspace via
syscall: sys_ptrace(), hence leading to a potential exploitation of the
Spectre variant 1 vulnerability.

The index can be controlled from:
ptrace -> arch_ptrace -> ptrace_get_debugreg.

Fix this by sanitizing the user supplied index before using it access
thread->ptrace_bps.

Signed-off-by: Dianzhang Chen 
Signed-off-by: Thomas Gleixner 
Cc: b...@alien8.de
Cc: h...@zytor.com
Cc: sta...@vger.kernel.org
Link: 
https://lkml.kernel.org/r/1561476617-3759-1-git-send-email-dianzhangch...@gmail.com

---
 arch/x86/kernel/ptrace.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index a166c960bc9e..cbac64659dc4 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -25,6 +25,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -643,9 +644,11 @@ static unsigned long ptrace_get_debugreg(struct 
task_struct *tsk, int n)
 {
struct thread_struct *thread = &tsk->thread;
unsigned long val = 0;
+   int index = n;
 
if (n < HBP_NUM) {
-   struct perf_event *bp = thread->ptrace_bps[n];
+   index = array_index_nospec(index, HBP_NUM);
+   struct perf_event *bp = thread->ptrace_bps[index];
 
if (bp)
val = bp->hw.info.address;

[tip:x86/pti] x86/tls: Fix possible spectre-v1 in do_get_thread_area()

[tip-bot for Dianzhang Chen]

Commit-ID:  993773d11d45c90cb1c6481c2638c3d9f092ea5b
Gitweb: https://git.kernel.org/tip/993773d11d45c90cb1c6481c2638c3d9f092ea5b
Author: Dianzhang Chen 
AuthorDate: Wed, 26 Jun 2019 12:50:30 +0800
Committer:  Thomas Gleixner 
CommitDate: Thu, 27 Jun 2019 23:48:04 +0200

x86/tls: Fix possible spectre-v1 in do_get_thread_area()

The index to access the threads tls array is controlled by userspace
via syscall: sys_ptrace(), hence leading to a potential exploitation
of the Spectre variant 1 vulnerability.

The index can be controlled from:
ptrace -> arch_ptrace -> do_get_thread_area.

Fix this by sanitizing the user supplied index before using it to access
the p->thread.tls_array.

Signed-off-by: Dianzhang Chen 
Signed-off-by: Thomas Gleixner 
Cc: b...@alien8.de
Cc: h...@zytor.com
Cc: sta...@vger.kernel.org
Link: 
https://lkml.kernel.org/r/1561524630-3642-1-git-send-email-dianzhangch...@gmail.com

---
 arch/x86/kernel/tls.c | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
index a5b802a12212..71d3fef1edc9 100644
--- a/arch/x86/kernel/tls.c
+++ b/arch/x86/kernel/tls.c
@@ -5,6 +5,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 #include 
@@ -220,6 +221,7 @@ int do_get_thread_area(struct task_struct *p, int idx,
   struct user_desc __user *u_info)
 {
struct user_desc info;
+   int index;
 
if (idx == -1 && get_user(idx, &u_info->entry_number))
return -EFAULT;
@@ -227,8 +229,11 @@ int do_get_thread_area(struct task_struct *p, int idx,
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
return -EINVAL;
 
-   fill_user_desc(&info, idx,
-  &p->thread.tls_array[idx - GDT_ENTRY_TLS_MIN]);
+   index = idx - GDT_ENTRY_TLS_MIN;
+   index = array_index_nospec(index,
+   GDT_ENTRY_TLS_MAX - GDT_ENTRY_TLS_MIN + 1);
+
+   fill_user_desc(&info, idx, &p->thread.tls_array[index]);
 
if (copy_to_user(u_info, &info, sizeof(info)))
return -EFAULT;