Commit 1928ac07 authored Aug 08, 2023 by Sami Tolvanen Committed by Ding Hui Aug 10, 2023

arm64: efi: Restore register x18 if it was corrupted

mainline inclusion
from mainline-v5.8-rc1
commit e73f02c6
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I67RIP
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e73f02c6eb15729164b9dd5e19214b54446823ab



--------------------------------

If we detect a corrupted x18, restore the register before jumping back
to potentially SCS instrumented code. This is safe, because the wrapper
is called with preemption disabled and a separate shadow stack is used
for interrupt handling.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>

parent 3a3a00dc

arch/arm64/kernel/efi-rt-wrapper.S

+10 −1

Original line number	Diff line number	Diff line
		@@ -37,5 +37,14 @@ ENTRY(__efi_rt_asm_wrapper)
		ldp x29, x30, [sp], #32
		b.ne 0f
		ret
		0: b efi_handle_corrupted_x18 // tail call
		0:
		/*
		* With CONFIG_SHADOW_CALL_STACK, the kernel uses x18 to store a
		* shadow stack pointer, which we need to restore before returning to
		* potentially instrumented code. This is safe because the wrapper is
		* called with preemption disabled and a separate shadow stack is used
		* for interrupts.
		*/
		mov x18, x2
		b efi_handle_corrupted_x18 // tail call
		ENDPROC(__efi_rt_asm_wrapper)