Home| summaryrefslogtreecommitdiff |
diff options
| author | Jeff Mahoney <jeffm@suse.de> | 2010-09-16 14:58:28 -0400 |
|---|---|---|
| committer | Jeff Mahoney <jeffm@suse.de> | 2010-09-16 14:58:38 -0400 |
| commit | fb77404ee89e0c39edfd61cc9fe6a64ad1fb39b7 (patch) | |
| tree | ab4afc61ecba065d49bcb134b8567aef4bd6f7fe | |
| parent | e6266b98cbc58a9ffe49fb4a652557fd5ddfae0d (diff) | |
- x86-64, compat: Test %rax for the syscall number, not %eaxrpm-2.6.36-16--openSUSE-11.4-Milestone2rpm-2.6.36-16
(CVE-2010-3301 bnc#639708).
| -rw-r--r-- | patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax | 101 | ||||
| -rw-r--r-- | series.conf | 1 |
2 files changed, 102 insertions, 0 deletions
diff --git a/patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax b/patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax new file mode 100644 index 0000000000..4f5477cea7 --- /dev/null +++ b/patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax @@ -0,0 +1,101 @@ +From: H. Peter Anvin <hpa@linux.intel.com> +Date: Tue, 14 Sep 2010 19:42:41 +0000 (-0700) +Subject: x86-64, compat: Test %rax for the syscall number, not %eax +Git-commit: 36d001c70d8a0144ac1d038f6876c484849a74de +References: CVE-2010-3301 bnc#639708 +Patch-mainline: 2.6.36 +Introduced-by: 2.6.27 + +x86-64, compat: Test %rax for the syscall number, not %eax + +On 64 bits, we always, by necessity, jump through the system call +table via %rax. For 32-bit system calls, in theory the system call +number is stored in %eax, and the code was testing %eax for a valid +system call number. At one point we loaded the stored value back from +the stack to enforce zero-extension, but that was removed in checkin +d4d67150165df8bf1cc05e532f6efca96f907cab. An actual 32-bit process +will not be able to introduce a non-zero-extended number, but it can +happen via ptrace. + +Instead of re-introducing the zero-extension, test what we are +actually going to use, i.e. %rax. This only adds a handful of REX +prefixes to the code. + +Reported-by: Ben Hawkes <hawkes@sota.gen.nz> +Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> +Cc: <stable@kernel.org> +Cc: Roland McGrath <roland@redhat.com> +Cc: Andrew Morton <akpm@linux-foundation.org> +Acked-by: Jeff Mahoney <jeffm@suse.com> +--- + + arch/x86/ia32/ia32entry.S | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S +index b86feab..84e3a4e 100644 +--- a/arch/x86/ia32/ia32entry.S ++++ b/arch/x86/ia32/ia32entry.S +@@ -153,7 +153,7 @@ ENTRY(ia32_sysenter_target) + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10) + CFI_REMEMBER_STATE + jnz sysenter_tracesys +- cmpl $(IA32_NR_syscalls-1),%eax ++ cmpq $(IA32_NR_syscalls-1),%rax + ja ia32_badsys + sysenter_do_call: + IA32_ARG_FIXUP +@@ -195,7 +195,7 @@ sysexit_from_sys_call: + movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */ + call audit_syscall_entry + movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */ +- cmpl $(IA32_NR_syscalls-1),%eax ++ cmpq $(IA32_NR_syscalls-1),%rax + ja ia32_badsys + movl %ebx,%edi /* reload 1st syscall arg */ + movl RCX-ARGOFFSET(%rsp),%esi /* reload 2nd syscall arg */ +@@ -248,7 +248,7 @@ sysenter_tracesys: + call syscall_trace_enter + LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */ + RESTORE_REST +- cmpl $(IA32_NR_syscalls-1),%eax ++ cmpq $(IA32_NR_syscalls-1),%rax + ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */ + jmp sysenter_do_call + CFI_ENDPROC +@@ -314,7 +314,7 @@ ENTRY(ia32_cstar_target) + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10) + CFI_REMEMBER_STATE + jnz cstar_tracesys +- cmpl $IA32_NR_syscalls-1,%eax ++ cmpq $IA32_NR_syscalls-1,%rax + ja ia32_badsys + cstar_do_call: + IA32_ARG_FIXUP 1 +@@ -367,7 +367,7 @@ cstar_tracesys: + LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */ + RESTORE_REST + xchgl %ebp,%r9d +- cmpl $(IA32_NR_syscalls-1),%eax ++ cmpq $(IA32_NR_syscalls-1),%rax + ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */ + jmp cstar_do_call + END(ia32_cstar_target) +@@ -425,7 +425,7 @@ ENTRY(ia32_syscall) + orl $TS_COMPAT,TI_status(%r10) + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10) + jnz ia32_tracesys +- cmpl $(IA32_NR_syscalls-1),%eax ++ cmpq $(IA32_NR_syscalls-1),%rax + ja ia32_badsys + ia32_do_call: + IA32_ARG_FIXUP +@@ -444,7 +444,7 @@ ia32_tracesys: + call syscall_trace_enter + LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */ + RESTORE_REST +- cmpl $(IA32_NR_syscalls-1),%eax ++ cmpq $(IA32_NR_syscalls-1),%rax + ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */ + jmp ia32_do_call + END(ia32_syscall) diff --git a/series.conf b/series.conf index 99035680a5..95198a327a 100644 --- a/series.conf +++ b/series.conf @@ -136,6 +136,7 @@ patches.suse/x86-mark_rodata_rw.patch patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing + patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax ######################################################## # x86 MCE/MCA (Machine Check Error/Architecture) extensions |