diff options
| author | Andi Kleen <ak@suse.de> | 2007-01-08 22:44:07 +0100 |
|---|---|---|
| committer | Adrian Bunk <bunk@stusta.de> | 2007-01-09 03:23:30 +0100 |
| commit | 493fa112a845d9ea5d24d429b0142090758f941b (patch) | |
| tree | 28cd6362e9bfc28da5d6589b1dc287a11eebf8a0 /include | |
| parent | be7b264ae676589398f8bff7ea53b01851f17be2 (diff) | |
x86_64: Don't leak NT bit into next task (CVE-2006-5755)
SYSENTER can cause a NT to be set which might cause crashes on the IRET
in the next task.
Following similar i386 patch from Linus.
Backport to 2.6.16 by Chuck Ebbert <76306.1226@compuserve.com>
[Changed 'set_debugreg' to the older 'set_debug' in setup64.c
and added raw_local_save_flags() from 2.6.19 to system.h]
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'include')
| -rw-r--r-- | include/asm-x86_64/system.h | 22 |
1 files changed, 20 insertions, 2 deletions
diff --git a/include/asm-x86_64/system.h b/include/asm-x86_64/system.h index b7f66034ae7..7b2c7aa2b06 100644 --- a/include/asm-x86_64/system.h +++ b/include/asm-x86_64/system.h @@ -20,12 +20,13 @@ #define __RESTORE(reg,offset) "movq (14-" #offset ")*8(%%rsp),%%" #reg "\n\t" /* frame pointer must be last for get_wchan */ -#define SAVE_CONTEXT "pushq %%rbp ; movq %%rsi,%%rbp\n\t" -#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp\n\t" +#define SAVE_CONTEXT "pushf ; pushq %%rbp ; movq %%rsi,%%rbp\n\t" +#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp ; popf\t" #define __EXTRA_CLOBBER \ ,"rcx","rbx","rdx","r8","r9","r10","r11","r12","r13","r14","r15" +/* Save restore flags to clear handle leaking NT */ #define switch_to(prev,next,last) \ asm volatile(SAVE_CONTEXT \ "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \ @@ -157,6 +158,23 @@ struct alt_instr { */ #define clts() __asm__ __volatile__ ("clts") +static inline unsigned long __raw_local_save_flags(void) +{ + unsigned long flags; + + __asm__ __volatile__( + "# __raw_save_flags\n\t" + "pushfq ; popq %q0" + : "=g" (flags) + : /* no input */ + : "memory" + ); + + return flags; +} +#define raw_local_save_flags(flags) \ + do { (flags) = __raw_local_save_flags(); } while (0) + static inline unsigned long read_cr0(void) { unsigned long cr0; |