Module Name: src
Committed By: maxv
Date: Thu Mar 23 17:25:51 UTC 2017
Modified Files:
src/sys/arch/amd64/amd64: locore.S machdep.c trap.c
Log Message:
Remove this call gate on amd64, it is useless and vulnerable.
Call gates do not modify %rflags, so interrupts are not disabled when
entering the gate. There is a small window where we are in kernel mode and
with a userland %gs, and if an interrupt happens here we will rejump into
the kernel but not switch to the kernel TLS.
Userland can simply perform a gate call in a loop, and hope that at some
point an interrupt will be received in this window - which necessarily will
be the case. With a specially-crafted %gs it is certainly enough to
escalate privileges.
To generate a diff of this commit:
cvs rdiff -u -r1.121 -r1.122 src/sys/arch/amd64/amd64/locore.S
cvs rdiff -u -r1.253 -r1.254 src/sys/arch/amd64/amd64/machdep.c
cvs rdiff -u -r1.94 -r1.95 src/sys/arch/amd64/amd64/trap.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/amd64/amd64/locore.S
diff -u src/sys/arch/amd64/amd64/locore.S:1.121 src/sys/arch/amd64/amd64/locore.S:1.122
--- src/sys/arch/amd64/amd64/locore.S:1.121 Thu Feb 9 19:30:56 2017
+++ src/sys/arch/amd64/amd64/locore.S Thu Mar 23 17:25:51 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: locore.S,v 1.121 2017/02/09 19:30:56 maxv Exp $ */
+/* $NetBSD: locore.S,v 1.122 2017/03/23 17:25:51 maxv Exp $ */
/*
* Copyright-o-rama!
@@ -1399,27 +1399,6 @@ NENTRY(lwp_trampoline)
END(lwp_trampoline)
/*
- * oosyscall()
- *
- * Old call gate entry for syscall. only needed if we're
- * going to support running old i386 NetBSD 1.0 or ibcs2 binaries, etc,
- * on NetBSD/amd64.
- * The 64bit call gate can't request that arguments be copied from the
- * user stack (which the i386 code uses to get a gap for the flags).
- * push/pop are <read>:<modify_sp>:<write> cycles.
- */
-IDTVEC(oosyscall)
- /* Set rflags in trap frame. */
- pushq (%rsp) /* move user's %eip */
- pushq 16(%rsp) /* and %cs */
- popq 8(%rsp)
- pushfq
- popq 16(%rsp)
- pushq $7 /* size of instruction for restart */
- jmp osyscall1
-IDTVEC_END(oosyscall)
-
-/*
* osyscall()
*
* Trap gate entry for int $80 syscall, also used by sigreturn.
Index: src/sys/arch/amd64/amd64/machdep.c
diff -u src/sys/arch/amd64/amd64/machdep.c:1.253 src/sys/arch/amd64/amd64/machdep.c:1.254
--- src/sys/arch/amd64/amd64/machdep.c:1.253 Fri Mar 10 14:54:12 2017
+++ src/sys/arch/amd64/amd64/machdep.c Thu Mar 23 17:25:51 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: machdep.c,v 1.253 2017/03/10 14:54:12 maxv Exp $ */
+/* $NetBSD: machdep.c,v 1.254 2017/03/23 17:25:51 maxv Exp $ */
/*-
* Copyright (c) 1996, 1997, 1998, 2000, 2006, 2007, 2008, 2011
@@ -111,7 +111,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.253 2017/03/10 14:54:12 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.254 2017/03/23 17:25:51 maxv Exp $");
/* #define XENDEBUG_LOW */
@@ -1452,7 +1452,6 @@ typedef void (vector)(void);
extern vector IDTVEC(syscall);
extern vector IDTVEC(syscall32);
extern vector IDTVEC(osyscall);
-extern vector IDTVEC(oosyscall);
extern vector *IDTVEC(exceptions)[];
static void
@@ -1642,11 +1641,8 @@ init_x86_64(paddr_t first_avail)
#endif
/*
- * Make LDT gates and memory segments.
+ * Make LDT memory segments.
*/
- setgate((struct gate_descriptor *)(ldtstore + LSYS5CALLS_SEL),
- &IDTVEC(oosyscall), 0, SDT_SYS386CGT, SEL_UPL,
- GSEL(GCODE_SEL, SEL_KPL));
*(struct mem_segment_descriptor *)(ldtstore + LUCODE_SEL) =
*GDT_ADDR_MEM(gdtstore, GUCODE_SEL);
*(struct mem_segment_descriptor *)(ldtstore + LUDATA_SEL) =
@@ -1677,16 +1673,6 @@ init_x86_64(paddr_t first_avail)
set_mem_segment(ldt_segp, 0, x86_btop(VM_MAXUSER_ADDRESS32) - 1,
SDT_MEMRWA, SEL_UPL, 1, 1, 0);
- /*
- * Other LDT entries.
- */
- memcpy((struct gate_descriptor *)(ldtstore + LSOL26CALLS_SEL),
- (struct gate_descriptor *)(ldtstore + LSYS5CALLS_SEL),
- sizeof (struct gate_descriptor));
- memcpy((struct gate_descriptor *)(ldtstore + LBSDICALLS_SEL),
- (struct gate_descriptor *)(ldtstore + LSYS5CALLS_SEL),
- sizeof (struct gate_descriptor));
-
/* CPU-specific IDT exceptions. */
for (x = 0; x < NCPUIDT; x++) {
#ifndef XEN
Index: src/sys/arch/amd64/amd64/trap.c
diff -u src/sys/arch/amd64/amd64/trap.c:1.94 src/sys/arch/amd64/amd64/trap.c:1.95
--- src/sys/arch/amd64/amd64/trap.c:1.94 Sat Mar 18 13:39:23 2017
+++ src/sys/arch/amd64/amd64/trap.c Thu Mar 23 17:25:51 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: trap.c,v 1.94 2017/03/18 13:39:23 maxv Exp $ */
+/* $NetBSD: trap.c,v 1.95 2017/03/23 17:25:51 maxv Exp $ */
/*-
* Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
@@ -68,7 +68,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.94 2017/03/18 13:39:23 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.95 2017/03/23 17:25:51 maxv Exp $");
#include "opt_ddb.h"
#include "opt_kgdb.h"
@@ -222,7 +222,6 @@ trap(struct trapframe *frame)
struct proc *p;
struct pcb *pcb;
extern char fusuintrfailure[], kcopy_fault[];
- extern char IDTVEC(oosyscall)[];
extern char IDTVEC(osyscall)[];
extern char IDTVEC(syscall32)[];
#ifndef XEN
@@ -692,8 +691,7 @@ faultcommon:
break;
/* Check whether they single-stepped into a lcall. */
- if (frame->tf_rip == (uint64_t)IDTVEC(oosyscall) ||
- frame->tf_rip == (uint64_t)IDTVEC(osyscall) ||
+ if (frame->tf_rip == (uint64_t)IDTVEC(osyscall) ||
frame->tf_rip == (uint64_t)IDTVEC(syscall32)) {
frame->tf_rflags &= ~PSL_T;
return;
