Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp2456749yba; Mon, 15 Apr 2019 12:02:52 -0700 (PDT) X-Google-Smtp-Source: APXvYqymb39jpft18tVVb9qI6sgb1UHGUqCmPlyINP4F1qxny47oLGsbOkkI/tyykfk7Sgz1xrWS X-Received: by 2002:a17:902:b717:: with SMTP id d23mr74707215pls.260.1555354972639; Mon, 15 Apr 2019 12:02:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1555354972; cv=none; d=google.com; s=arc-20160816; b=aGWE/6x2RedYiIruuWPK6Lu68gWuj4rbZ2SdJFNFxX/QqX81BxEJ2r/y/64MiKzz3/ YK5WYLw4EQT6wB49mGGL0YPtb0JAKf1KqrIYIXw9Ndv2KXNdxGY0lQ49ZRNJcQ0YK21e H1EX7QeWyOUbiOH9+m91VWIf+gbGgnlkOgyAfAj65lWzD6DHzqQVvJ1UQF/hK6qKF99M VNrsLH4rdPHAH5/t0eH/WLKdKlcAffrrCfBl2AOHaAfqRbUQe6e55VmWYhJdcWOpbYMW Vnfc8mStwLcB2VNh4zXMOweHg/+0rZhOlCI/Wn5wM7/GwNHlBt2Aw9/ocOLxJxYDB0At j1Rw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=OMLCD9N5A+gfCvY747bGNcuxiPg3bJm6oqVudvgZ9xU=; b=sAxgwnIepBF3arBZXVLao9/dNF23TnWLaPTL2yORIRuKa6J1pl9UM3Q052JgheEuNF EHS/qwuFRRpC7e8ZgBUQIwRdu8lkluBzYD+q/XNh/S4mt894RrT4o9VYrV57/mcJEj8l lwIOBuoLkUFH1eDWF6YIXrmr2SbQbd8Ylz/y+7d+sU7SyqzmG8nDrUr/zS8AGIcAJuVc aQng8bM+SXCo4+FxUtBQoERPg8o/hnfGU7XmJ5XPb0I3RJYjNluI2iyJxjbPX0DXPe5l eZ79D9DY/6RZteFVu99jUNWqKROzM91FbmIIzGGgrASJ3UM1YSHFPVwd6Oy0Rlpo69mI pRsQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=v533fLOo; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id x5si25115137pfo.84.2019.04.15.12.02.35; Mon, 15 Apr 2019 12:02:52 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=v533fLOo; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728340AbfDOTBv (ORCPT + 99 others); Mon, 15 Apr 2019 15:01:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:60356 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728126AbfDOTBt (ORCPT ); Mon, 15 Apr 2019 15:01:49 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 965DC20880; Mon, 15 Apr 2019 19:01:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1555354909; bh=Vxn6kEK8V6CTO6SqayJzf9iM2FuaFlfub7/w9Wd5qqs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v533fLOoB3sJxBlV//i+7QK05PuuAXauQy+2OHygPscjFCZDA5iMgPlJ49SSXZ8Ns Xyp2ln7nMQu1AEBFiXb4aaAJJca1mqfvIoG9a/jPemebnbq7t9iL8zPMzj5k9p+KLA zxWfLnNzJfv2QCBSSYL5MshWVYrbnjmUaRhmZzFc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jarkko Nikula , Andy Lutomirski , Thomas Gleixner , Peter Zijlstra , Borislav Petkov , Linus Torvalds , Ingo Molnar , Sasha Levin Subject: [PATCH 4.14 02/69] x86/power: Fix some ordering bugs in __restore_processor_context() Date: Mon, 15 Apr 2019 20:58:20 +0200 Message-Id: <20190415183726.624072882@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190415183726.036654568@linuxfoundation.org> References: <20190415183726.036654568@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit 5b06bbcfc2c621da3009da8decb7511500c293ed ] __restore_processor_context() had a couple of ordering bugs. It restored GSBASE after calling load_gs_index(), and the latter can call into tracing code. It also tried to restore segment registers before restoring the LDT, which is straight-up wrong. Reorder the code so that we restore GSBASE, then the descriptor tables, then the segments. This fixes two bugs. First, it fixes a regression that broke resume under certain configurations due to irqflag tracing in native_load_gs_index(). Second, it fixes resume when the userspace process that initiated suspect had funny segments. The latter can be reproduced by compiling this: // SPDX-License-Identifier: GPL-2.0 /* * ldt_echo.c - Echo argv[1] while using an LDT segment */ int main(int argc, char **argv) { int ret; size_t len; char *buf; const struct user_desc desc = { .entry_number = 0, .base_addr = 0, .limit = 0xfffff, .seg_32bit = 1, .contents = 0, /* Data, grow-up */ .read_exec_only = 0, .limit_in_pages = 1, .seg_not_present = 0, .useable = 0 }; if (argc != 2) errx(1, "Usage: %s STRING", argv[0]); len = asprintf(&buf, "%s\n", argv[1]); if (len < 0) errx(1, "Out of memory"); ret = syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)); if (ret < -1) errno = -ret; if (ret) err(1, "modify_ldt"); asm volatile ("movw %0, %%es" :: "rm" ((unsigned short)7)); write(1, buf, len); return 0; } and running ldt_echo >/sys/power/mem Without the fix, the latter causes a triple fault on resume. Fixes: ca37e57bbe0c ("x86/entry/64: Add missing irqflags tracing to native_load_gs_index()") Reported-by: Jarkko Nikula Signed-off-by: Andy Lutomirski Signed-off-by: Thomas Gleixner Tested-by: Jarkko Nikula Cc: Peter Zijlstra Cc: Borislav Petkov Cc: Linus Torvalds Link: https://lkml.kernel.org/r/6b31721ea92f51ea839e79bd97ade4a75b1eeea2.1512057304.git.luto@kernel.org Signed-off-by: Ingo Molnar Signed-off-by: Sasha Levin --- arch/x86/power/cpu.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c index 04d5157fe7f8..a51d2dfb57d1 100644 --- a/arch/x86/power/cpu.c +++ b/arch/x86/power/cpu.c @@ -228,8 +228,20 @@ static void notrace __restore_processor_state(struct saved_context *ctxt) load_idt((const struct desc_ptr *)&ctxt->idt_limit); #endif +#ifdef CONFIG_X86_64 /* - * segment registers + * We need GSBASE restored before percpu access can work. + * percpu access can happen in exception handlers or in complicated + * helpers like load_gs_index(). + */ + wrmsrl(MSR_GS_BASE, ctxt->gs_base); +#endif + + fix_processor_context(); + + /* + * Restore segment registers. This happens after restoring the GDT + * and LDT, which happen in fix_processor_context(). */ #ifdef CONFIG_X86_32 loadsegment(es, ctxt->es); @@ -250,13 +262,14 @@ static void notrace __restore_processor_state(struct saved_context *ctxt) load_gs_index(ctxt->gs); asm volatile ("movw %0, %%ss" :: "r" (ctxt->ss)); + /* + * Restore FSBASE and user GSBASE after reloading the respective + * segment selectors. + */ wrmsrl(MSR_FS_BASE, ctxt->fs_base); - wrmsrl(MSR_GS_BASE, ctxt->gs_base); wrmsrl(MSR_KERNEL_GS_BASE, ctxt->gs_kernel_base); #endif - fix_processor_context(); - do_fpu_end(); tsc_verify_tsc_adjust(true); x86_platform.restore_sched_clock_state(); -- 2.19.1