Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757158AbbDWK1U (ORCPT ); Thu, 23 Apr 2015 06:27:20 -0400 Received: from mx1.redhat.com ([209.132.183.28]:46091 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754528AbbDWK1T (ORCPT ); Thu, 23 Apr 2015 06:27:19 -0400 Message-ID: <5538C8E3.60009@redhat.com> Date: Thu, 23 Apr 2015 12:26:43 +0200 From: Denys Vlasenko User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Borislav Petkov CC: Andy Lutomirski , Brian Gerst , Steven Rostedt , Oleg Nesterov , Ingo Molnar , "H. Peter Anvin" , Linus Torvalds , Andy Lutomirski , Will Drewry , =?UTF-8?B?RnLDqWTDqXJpYyBXZWlzYmVja2Vy?= , Alexei Starovoitov , Linux Kernel Mailing List , Kees Cook , Thomas Gleixner , "linux-tip-commits@vger.kernel.org" Subject: Re: [tip:x86/vdso] x86/vdso32/syscall.S: Do not load __USER32_DS to %ss References: <63da6d778f69fd0f1345d9287f6764d58be519fa.1427482099.git.luto@kernel.org> <5538C1C5.7010408@redhat.com> <20150423101840.GC28327@pd.tnic> In-Reply-To: <20150423101840.GC28327@pd.tnic> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1235 Lines: 30 On 04/23/2015 12:18 PM, Borislav Petkov wrote: > On Thu, Apr 23, 2015 at 11:56:21AM +0200, Denys Vlasenko wrote: >> The fix can look like this (untested): >> >> >> diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S >> index 0c302d0..9f4c232 100644 >> --- a/arch/x86/ia32/ia32entry.S >> +++ b/arch/x86/ia32/ia32entry.S >> @@ -198,6 +198,18 @@ sysexit_from_sys_call: >> * with 'sysenter' and it uses the SYSENTER calling convention. >> */ >> andl $~TS_COMPAT,ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS) >> + /* >> + * On AMD, SYSRET32 does not modify %ss cached descriptor; > > Ok, but doc says that in both long and compat mode, SYSRET does load > SS.sel with the value in MSR_STAR... Yes. It loads *selector*. AMD docs say that selector is loaded as you say, but *cached descriptor* of SS (which is a different entity) is not modified. If *cached descriptor* is invalid, in 32-bit mode stack ops will fail. (In 64-bit mode, CPU doesn't do those checks). -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/