Home Home > GIT Browse > SLE12-SP5-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeff Mahoney <jeffm@suse.de>2010-09-16 14:58:28 -0400
committerJeff Mahoney <jeffm@suse.de>2010-09-16 14:58:38 -0400
commitfb77404ee89e0c39edfd61cc9fe6a64ad1fb39b7 (patch)
treeab4afc61ecba065d49bcb134b8567aef4bd6f7fe
parente6266b98cbc58a9ffe49fb4a652557fd5ddfae0d (diff)
- x86-64, compat: Test %rax for the syscall number, not %eaxrpm-2.6.36-16--openSUSE-11.4-Milestone2rpm-2.6.36-16
(CVE-2010-3301 bnc#639708).
-rw-r--r--patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax101
-rw-r--r--series.conf1
2 files changed, 102 insertions, 0 deletions
diff --git a/patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax b/patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax
new file mode 100644
index 0000000000..4f5477cea7
--- /dev/null
+++ b/patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax
@@ -0,0 +1,101 @@
+From: H. Peter Anvin <hpa@linux.intel.com>
+Date: Tue, 14 Sep 2010 19:42:41 +0000 (-0700)
+Subject: x86-64, compat: Test %rax for the syscall number, not %eax
+Git-commit: 36d001c70d8a0144ac1d038f6876c484849a74de
+References: CVE-2010-3301 bnc#639708
+Patch-mainline: 2.6.36
+Introduced-by: 2.6.27
+
+x86-64, compat: Test %rax for the syscall number, not %eax
+
+On 64 bits, we always, by necessity, jump through the system call
+table via %rax. For 32-bit system calls, in theory the system call
+number is stored in %eax, and the code was testing %eax for a valid
+system call number. At one point we loaded the stored value back from
+the stack to enforce zero-extension, but that was removed in checkin
+d4d67150165df8bf1cc05e532f6efca96f907cab. An actual 32-bit process
+will not be able to introduce a non-zero-extended number, but it can
+happen via ptrace.
+
+Instead of re-introducing the zero-extension, test what we are
+actually going to use, i.e. %rax. This only adds a handful of REX
+prefixes to the code.
+
+Reported-by: Ben Hawkes <hawkes@sota.gen.nz>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Cc: <stable@kernel.org>
+Cc: Roland McGrath <roland@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Jeff Mahoney <jeffm@suse.com>
+---
+
+ arch/x86/ia32/ia32entry.S | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
+index b86feab..84e3a4e 100644
+--- a/arch/x86/ia32/ia32entry.S
++++ b/arch/x86/ia32/ia32entry.S
+@@ -153,7 +153,7 @@ ENTRY(ia32_sysenter_target)
+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
+ CFI_REMEMBER_STATE
+ jnz sysenter_tracesys
+- cmpl $(IA32_NR_syscalls-1),%eax
++ cmpq $(IA32_NR_syscalls-1),%rax
+ ja ia32_badsys
+ sysenter_do_call:
+ IA32_ARG_FIXUP
+@@ -195,7 +195,7 @@ sysexit_from_sys_call:
+ movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
+ call audit_syscall_entry
+ movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
+- cmpl $(IA32_NR_syscalls-1),%eax
++ cmpq $(IA32_NR_syscalls-1),%rax
+ ja ia32_badsys
+ movl %ebx,%edi /* reload 1st syscall arg */
+ movl RCX-ARGOFFSET(%rsp),%esi /* reload 2nd syscall arg */
+@@ -248,7 +248,7 @@ sysenter_tracesys:
+ call syscall_trace_enter
+ LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
+ RESTORE_REST
+- cmpl $(IA32_NR_syscalls-1),%eax
++ cmpq $(IA32_NR_syscalls-1),%rax
+ ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
+ jmp sysenter_do_call
+ CFI_ENDPROC
+@@ -314,7 +314,7 @@ ENTRY(ia32_cstar_target)
+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
+ CFI_REMEMBER_STATE
+ jnz cstar_tracesys
+- cmpl $IA32_NR_syscalls-1,%eax
++ cmpq $IA32_NR_syscalls-1,%rax
+ ja ia32_badsys
+ cstar_do_call:
+ IA32_ARG_FIXUP 1
+@@ -367,7 +367,7 @@ cstar_tracesys:
+ LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
+ RESTORE_REST
+ xchgl %ebp,%r9d
+- cmpl $(IA32_NR_syscalls-1),%eax
++ cmpq $(IA32_NR_syscalls-1),%rax
+ ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
+ jmp cstar_do_call
+ END(ia32_cstar_target)
+@@ -425,7 +425,7 @@ ENTRY(ia32_syscall)
+ orl $TS_COMPAT,TI_status(%r10)
+ testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
+ jnz ia32_tracesys
+- cmpl $(IA32_NR_syscalls-1),%eax
++ cmpq $(IA32_NR_syscalls-1),%rax
+ ja ia32_badsys
+ ia32_do_call:
+ IA32_ARG_FIXUP
+@@ -444,7 +444,7 @@ ia32_tracesys:
+ call syscall_trace_enter
+ LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
+ RESTORE_REST
+- cmpl $(IA32_NR_syscalls-1),%eax
++ cmpq $(IA32_NR_syscalls-1),%rax
+ ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */
+ jmp ia32_do_call
+ END(ia32_syscall)
diff --git a/series.conf b/series.conf
index 99035680a5..95198a327a 100644
--- a/series.conf
+++ b/series.conf
@@ -136,6 +136,7 @@
patches.suse/x86-mark_rodata_rw.patch
patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing
+ patches.fixes/x86-64-compat-test-rax-for-the-syscall-number-not-eax
########################################################
# x86 MCE/MCA (Machine Check Error/Architecture) extensions