提交 658fdbef 编写于 作者: A Andi Kleen 提交者: Andi Kleen

[PATCH] Don't leak NT bit into next task

SYSENTER can cause a NT to be set which might cause crashes on the IRET
in the next task.

Following similar i386 patch from Linus.
Signed-off-by: NAndi Kleen <ak@suse.de>
上级 adf14236
...@@ -155,6 +155,10 @@ ...@@ -155,6 +155,10 @@
/* rdi: prev */ /* rdi: prev */
ENTRY(ret_from_fork) ENTRY(ret_from_fork)
CFI_DEFAULT_STACK CFI_DEFAULT_STACK
push kernel_eflags(%rip)
CFI_ADJUST_CFA_OFFSET 4
popf # reset kernel eflags
CFI_ADJUST_CFA_OFFSET -4
call schedule_tail call schedule_tail
GET_THREAD_INFO(%rcx) GET_THREAD_INFO(%rcx)
testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT),threadinfo_flags(%rcx) testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT),threadinfo_flags(%rcx)
......
...@@ -180,6 +180,8 @@ void __cpuinit check_efer(void) ...@@ -180,6 +180,8 @@ void __cpuinit check_efer(void)
} }
} }
unsigned long kernel_eflags;
/* /*
* cpu_init() initializes state that is per-CPU. Some data is already * cpu_init() initializes state that is per-CPU. Some data is already
* initialized (naturally) in the bootstrap process, such as the GDT * initialized (naturally) in the bootstrap process, such as the GDT
...@@ -281,4 +283,6 @@ void __cpuinit cpu_init (void) ...@@ -281,4 +283,6 @@ void __cpuinit cpu_init (void)
set_debugreg(0UL, 7); set_debugreg(0UL, 7);
fpu_init(); fpu_init();
raw_local_save_flags(kernel_eflags);
} }
...@@ -14,12 +14,13 @@ ...@@ -14,12 +14,13 @@
#define __RESTORE(reg,offset) "movq (14-" #offset ")*8(%%rsp),%%" #reg "\n\t" #define __RESTORE(reg,offset) "movq (14-" #offset ")*8(%%rsp),%%" #reg "\n\t"
/* frame pointer must be last for get_wchan */ /* frame pointer must be last for get_wchan */
#define SAVE_CONTEXT "pushq %%rbp ; movq %%rsi,%%rbp\n\t" #define SAVE_CONTEXT "pushf ; pushq %%rbp ; movq %%rsi,%%rbp\n\t"
#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp\n\t" #define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp ; popf\t"
#define __EXTRA_CLOBBER \ #define __EXTRA_CLOBBER \
,"rcx","rbx","rdx","r8","r9","r10","r11","r12","r13","r14","r15" ,"rcx","rbx","rdx","r8","r9","r10","r11","r12","r13","r14","r15"
/* Save restore flags to clear handle leaking NT */
#define switch_to(prev,next,last) \ #define switch_to(prev,next,last) \
asm volatile(SAVE_CONTEXT \ asm volatile(SAVE_CONTEXT \
"movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \ "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册