Commit 0aca53c6 authored by Lai Jiangshan's avatar Lai Jiangshan Committed by Borislav Petkov
Browse files

x86/traps: Use pt_regs directly in fixup_bad_iret() 



Always stash the address error_entry() is going to return to, in %r12
and get rid of the void *error_entry_ret; slot in struct bad_iret_stack
which was supposed to account for it and pt_regs pushed on the stack.

After this, both fixup_bad_iret() and sync_regs() can work on a struct
pt_regs pointer directly.

  [ bp: Rewrite commit message, touch ups. ]

Signed-off-by: default avatarLai Jiangshan <jiangshan.ljs@antgroup.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Link: https://lore.kernel.org/r/20220503032107.680190-2-jiangshanlai@gmail.com
parent 672c0c51

arch/x86/entry/entry_64.S

+4 −1
Original line number Diff line number Diff line
@@ -1061,9 +1061,12 @@ SYM_CODE_START_LOCAL(error_entry) 
	 * Pretend that the exception came from user mode: set up pt_regs

	 * as if we faulted immediately after IRET.

	 */

	mov	%rsp, %rdi

	popq	%r12				/* save return addr in %12 */

	movq	%rsp, %rdi			/* arg0 = pt_regs pointer */

	call	fixup_bad_iret

	mov	%rax, %rsp

	ENCODE_FRAME_POINTER

	pushq	%r12

	jmp	.Lerror_entry_from_usermode_after_swapgs

SYM_CODE_END(error_entry)

arch/x86/include/asm/traps.h

+1 −1
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ 
#ifdef CONFIG_X86_64

asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs);

asmlinkage __visible notrace

struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s);

struct pt_regs *fixup_bad_iret(struct pt_regs *bad_regs);

void __init trap_init(void);

asmlinkage __visible noinstr struct pt_regs *vc_switch_off_ist(struct pt_regs *eregs);

#endif

arch/x86/kernel/traps.c

+7 −12
Original line number Diff line number Diff line
@@ -892,14 +892,10 @@ asmlinkage __visible noinstr struct pt_regs *vc_switch_off_ist(struct pt_regs *r 
}

#endif



struct bad_iret_stack {

	void *error_entry_ret;

	struct pt_regs regs;

};



asmlinkage __visible noinstr

struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)

asmlinkage __visible noinstr struct pt_regs *fixup_bad_iret(struct pt_regs *bad_regs)

{

	struct pt_regs tmp, *new_stack;



	/*

	 * This is called from entry_64.S early in handling a fault

	 * caused by a bad iret to user mode.  To handle the fault
@@ -908,19 +904,18 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s) 
	 * just below the IRET frame) and we want to pretend that the

	 * exception came from the IRET target.

	 */

	struct bad_iret_stack tmp, *new_stack =

		(struct bad_iret_stack *)__this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;

	new_stack = (struct pt_regs *)__this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;



	/* Copy the IRET target to the temporary storage. */

	__memcpy(&tmp.regs.ip, (void *)s->regs.sp, 5*8);

	__memcpy(&tmp.ip, (void *)bad_regs->sp, 5*8);



	/* Copy the remainder of the stack from the current stack. */

	__memcpy(&tmp, s, offsetof(struct bad_iret_stack, regs.ip));

	__memcpy(&tmp, bad_regs, offsetof(struct pt_regs, ip));



	/* Update the entry stack */

	__memcpy(new_stack, &tmp, sizeof(tmp));



	BUG_ON(!user_mode(&new_stack->regs));

	BUG_ON(!user_mode(new_stack));

	return new_stack;

}

#endif