100 lines
3.5 KiB
Plaintext
100 lines
3.5 KiB
Plaintext
|
From: H. Peter Anvin <hpa@linux.intel.com>
|
||
|
|
Date: Tue, 14 Sep 2010 19:42:41 +0000 (-0700)
|
||
|
|
Subject: x86-64, compat: Test %rax for the syscall number, not %eax
|
||
|
|
Git-commit: 36d001c70d8a0144ac1d038f6876c484849a74de
|
||
|
|
References: CVE-2010-3301 bnc#639708
|
||
|
|
Patch-mainline: 2.6.36
|
||
|
|
Introduced-by: 2.6.27
|
||
|
|
|
||
|
|
x86-64, compat: Test %rax for the syscall number, not %eax
|
||
|
|
|
||
|
|
On 64 bits, we always, by necessity, jump through the system call
|
||
|
|
table via %rax. For 32-bit system calls, in theory the system call
|
||
|
|
number is stored in %eax, and the code was testing %eax for a valid
|
||
|
|
system call number. At one point we loaded the stored value back from
|
||
|
|
the stack to enforce zero-extension, but that was removed in checkin
|
||
|
|
d4d67150165df8bf1cc05e532f6efca96f907cab. An actual 32-bit process
|
||
|
|
will not be able to introduce a non-zero-extended number, but it can
|
||
|
|
happen via ptrace.
|
||
|
|
|
||
|
|
Instead of re-introducing the zero-extension, test what we are
|
||
|
|
actually going to use, i.e. %rax. This only adds a handful of REX
|
||
|
|
prefixes to the code.
|
||
|
|
|
||
|
|
Reported-by: Ben Hawkes <hawkes@sota.gen.nz>
|
||
|
|
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
|
||
|
|
Cc: <stable@kernel.org>
|
||
|
|
Cc: Roland McGrath <roland@redhat.com>
|
||
|
|
Cc: Andrew Morton <akpm@linux-foundation.org>
|
||
|
|
Acked-by: Jeff Mahoney <jeffm@suse.com>
|
||
|
|
---
|
||
|
|
|
||
|
|
arch/x86/ia32/ia32entry.S | 14 +++++++-------
|
||
|
|
1 file changed, 7 insertions(+), 7 deletions(-)
|
||
|
|
|
||
|
|
--- a/arch/x86/ia32/ia32entry.S
|
||
|
|
+++ b/arch/x86/ia32/ia32entry.S
|
||
|
|
@@ -159,7 +159,7 @@ ENTRY(ia32_sysenter_target)
|
||
|
|
testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
|
||
|
|
CFI_REMEMBER_STATE
|
||
|
|
jnz sysenter_tracesys
|
||
|
|
- cmpl $(IA32_NR_syscalls-1),%eax
|
||
|
|
+ cmpq $(IA32_NR_syscalls-1),%rax
|
||
|
|
ja ia32_badsys
|
||
|
|
sysenter_do_call:
|
||
|
|
IA32_ARG_FIXUP
|
||
|
|
@@ -201,7 +201,7 @@ sysexit_from_sys_call:
|
||
|
|
movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
|
||
|
|
call audit_syscall_entry
|
||
|
|
movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
|
||
|
|
- cmpl $(IA32_NR_syscalls-1),%eax
|
||
|
|
+ cmpq $(IA32_NR_syscalls-1),%rax
|
||
|
|
ja ia32_badsys
|
||
|
|
movl %ebx,%edi /* reload 1st syscall arg */
|
||
|
|
movl RCX-ARGOFFSET(%rsp),%esi /* reload 2nd syscall arg */
|
||
|
|
@@ -254,7 +254,7 @@ sysenter_tracesys:
|
||
|
|
call syscall_trace_enter
|
||
|
|
LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
|
||
|
|
RESTORE_REST
|
||
|
|
- cmpl $(IA32_NR_syscalls-1),%eax
|
||
|
|
+ cmpq $(IA32_NR_syscalls-1),%rax
|
||
|
|
ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
|
||
|
|
jmp sysenter_do_call
|
||
|
|
CFI_ENDPROC
|
||
|
|
@@ -320,7 +320,7 @@ ENTRY(ia32_cstar_target)
|
||
|
|
testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
|
||
|
|
CFI_REMEMBER_STATE
|
||
|
|
jnz cstar_tracesys
|
||
|
|
- cmpl $IA32_NR_syscalls-1,%eax
|
||
|
|
+ cmpq $IA32_NR_syscalls-1,%rax
|
||
|
|
ja ia32_badsys
|
||
|
|
cstar_do_call:
|
||
|
|
IA32_ARG_FIXUP 1
|
||
|
|
@@ -373,7 +373,7 @@ cstar_tracesys:
|
||
|
|
LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
|
||
|
|
RESTORE_REST
|
||
|
|
xchgl %ebp,%r9d
|
||
|
|
- cmpl $(IA32_NR_syscalls-1),%eax
|
||
|
|
+ cmpq $(IA32_NR_syscalls-1),%rax
|
||
|
|
ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
|
||
|
|
jmp cstar_do_call
|
||
|
|
END(ia32_cstar_target)
|
||
|
|
@@ -431,7 +431,7 @@ ENTRY(ia32_syscall)
|
||
|
|
orl $TS_COMPAT,TI_status(%r10)
|
||
|
|
testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
|
||
|
|
jnz ia32_tracesys
|
||
|
|
- cmpl $(IA32_NR_syscalls-1),%eax
|
||
|
|
+ cmpq $(IA32_NR_syscalls-1),%rax
|
||
|
|
ja ia32_badsys
|
||
|
|
ia32_do_call:
|
||
|
|
IA32_ARG_FIXUP
|
||
|
|
@@ -450,7 +450,7 @@ ia32_tracesys:
|
||
|
|
call syscall_trace_enter
|
||
|
|
LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
|
||
|
|
RESTORE_REST
|
||
|
|
- cmpl $(IA32_NR_syscalls-1),%eax
|
||
|
|
+ cmpq $(IA32_NR_syscalls-1),%rax
|
||
|
|
ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */
|
||
|
|
jmp ia32_do_call
|
||
|
|
END(ia32_syscall)
|