After a page fault from userland, the kernel is entered and it switches
the stack to the PTI stack which is mapped both in the kernel and in
the user page-table. When executing the page fault handler, switch
to the kernel stack (which is mapped only in the kernel page-table)
so that no kernel data leak to the userland through the stack.
Signed-off-by: Alexandre Chartre <[email protected]>
---
arch/x86/include/asm/idtentry.h | 17 +++++++++++++++++
arch/x86/mm/fault.c | 2 +-
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/idtentry.h b/arch/x86/include/asm/idtentry.h
index 0c5d9f027112..a6725afaaec0 100644
--- a/arch/x86/include/asm/idtentry.h
+++ b/arch/x86/include/asm/idtentry.h
@@ -31,6 +31,13 @@ void idtentry_exit_nmi(struct pt_regs *regs, bool irq_state);
(void (*)(void))(func), (void *)(arg1), (void *)(arg2)) : \
func(arg1, arg2))
+#define CALL_ON_STACK_3(stack, func, arg1, arg2, arg3) \
+ ((stack) ? \
+ asm_call_on_stack_3(stack, \
+ (void (*)(void))(func), (void *)(arg1), (void *)(arg2), \
+ (void *)(arg3)) : \
+ func(arg1, arg2, arg3))
+
/*
* Functions to return the top of the kernel stack if we are using the
* user page-table (and thus not running with the kernel stack). If we
@@ -66,6 +73,16 @@ void run_idt_errcode(void (*func)(struct pt_regs *, unsigned long),
CALL_ON_STACK_2(pti_kernel_stack(regs), func, regs, error_code);
}
+static __always_inline
+void run_idt_pagefault(void (*func)(struct pt_regs *, unsigned long,
+ unsigned long),
+ struct pt_regs *regs, unsigned long error_code,
+ unsigned long address)
+{
+ CALL_ON_STACK_3(pti_kernel_stack(regs),
+ func, regs, error_code, address);
+}
+
static __always_inline
void run_sysvec(void (*func)(struct pt_regs *regs), struct pt_regs *regs)
{
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 82bf37a5c9ec..b9d03603d95d 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1482,7 +1482,7 @@ DEFINE_IDTENTRY_RAW_ERRORCODE(exc_page_fault)
state = irqentry_enter(regs);
instrumentation_begin();
- handle_page_fault(regs, error_code, address);
+ run_idt_pagefault(handle_page_fault, regs, error_code, address);
instrumentation_end();
irqentry_exit(regs, state);
--
2.18.4