Jan Beulich 13d2b4d11d x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS. ... This fixes CVE-2013-0228 / XSA-42 Drew Jones while working on CVE-2013-0190 found that that unprivileged guest user in 32bit PV guest can use to crash the > guest with the panic like this: ------------- general protection fault: 0000 [#1] SMP last sysfs file: /sys/devices/vbd-51712/block/xvda/dev Modules linked in: sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 xen_netfront ext4 mbcache jbd2 xen_blkfront dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan] Pid: 1250, comm: r Not tainted 2.6.32-356.el6.i686 #1 EIP: 0061:[<c0407462>] EFLAGS: 00010086 CPU: 0 EIP is at xen_iret+0x12/0x2b EAX: eb8d0000 EBX: 00000001 ECX: 08049860 EDX: 00000010 ESI: 00000000 EDI: 003d0f00 EBP: b77f8388 ESP: eb8d1fe0 DS: 0000 ES: 007b FS: 0000 GS: 00e0 SS: 0069 Process r (pid: 1250, ti=eb8d0000 task=c2953550 task.ti=eb8d0000) Stack: 00000000 0027f416 00000073 00000206 b77f8364 0000007b 00000000 00000000 Call Trace: Code: c3 8b 44 24 18 81 4c 24 38 00 02 00 00 8d 64 24 30 e9 03 00 00 00 8d 76 00 f7 44 24 08 00 00 02 80 75 33 50 b8 00 e0 ff ff 21 e0 <8b> 40 10 8b 04 85 a0 f6 ab c0 8b 80 0c b0 b3 c0 f6 44 24 0d 02 EIP: [<c0407462>] xen_iret+0x12/0x2b SS:ESP 0069:eb8d1fe0 general protection fault: 0000 [#2] ---[ end trace ab0d29a492dcd330 ]--- Kernel panic - not syncing: Fatal exception Pid: 1250, comm: r Tainted: G D --------------- 2.6.32-356.el6.i686 #1 Call Trace: [<c08476df>] ? panic+0x6e/0x122 [<c084b63c>] ? oops_end+0xbc/0xd0 [<c084b260>] ? do_general_protection+0x0/0x210 [<c084a9b7>] ? error_code+0x73/ ------------- Petr says: " I've analysed the bug and I think that xen_iret() cannot cope with mangled DS, in this case zeroed out (null selector/descriptor) by either xen_failsafe_callback() or RESTORE_REGS because the corresponding LDT entry was invalidated by the reproducer. " Jan took a look at the preliminary patch and came up a fix that solves this problem: "This code gets called after all registers other than those handled by IRET got already restored, hence a null selector in %ds or a non-null one that got loaded from a code or read-only data descriptor would cause a kernel mode fault (with the potential of crashing the kernel as a whole, if panic_on_oops is set)." The way to fix this is to realize that the we can only relay on the registers that IRET restores. The two that are guaranteed are the %cs and %ss as they are always fixed GDT selectors. Also they are inaccessible from user mode - so they cannot be altered. This is the approach taken in this patch. Another alternative option suggested by Jan would be to relay on the subtle realization that using the %ebp or %esp relative references uses the %ss segment. In which case we could switch from using %eax to %ebp and would not need the %ss over-rides. That would also require one extra instruction to compensate for the one place where the register is used as scaled index. However Andrew pointed out that is too subtle and if further work was to be done in this code-path it could escape folks attention and lead to accidents. Reviewed-by: Petr Matousek <pmatouse@redhat.com> Reported-by: Petr Matousek <pmatouse@redhat.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>		2013-02-13 15:40:30 -05:00
..
boot	x86, efi: Fix processor-specific memcpy() build error	2012-11-20 20:52:07 +00:00
configs	x86/Kconfig: Turn off DEBUG_NX_TEST module in defconfigs	2012-09-05 10:43:12 +02:00
crypto	crypto: aesni - fix XTS mode on x86-32, add wrapper function for asmlinkage aesni_enc()	2012-10-18 14:01:33 -07:00
ia32	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal	2012-10-10 12:02:25 +09:00
include	Linux 3.7	2013-01-15 15:58:25 -05:00
kernel	xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.	2013-01-16 16:17:42 -05:00
kvm	x86, kvm: Remove incorrect redundant assembly constraint	2012-11-26 15:52:48 -08:00
lguest	virtio: remove CONFIG_VIRTIO_RING	2012-09-28 15:05:15 +09:30
lib	UAPI: x86: Fix insn_sanity build failure after UAPI split	2012-10-02 18:01:56 +01:00
math-emu
mm	x86, mm: Correct vmflag test for checking VM_HUGETLB	2012-11-14 15:03:20 -08:00
net	x86: bpf_jit_comp: add XOR instruction for BPF JIT	2012-09-24 16:54:35 -04:00
oprofile	oprofile, x86: Fix wrapping bug in op_x86_get_ctrl()	2012-10-15 14:38:24 +02:00
pci	x86/ce4100: Fix PCI configuration register access for devices without interrupts	2012-10-30 10:16:47 +01:00
platform	x86/ce4100: Fix reboot by forcing the reboot method to be KBD	2012-10-30 10:16:46 +01:00
power
realmode	x86, suspend: Correct the restore of CR4, EFER; skip computing EFLAGS.ID	2012-10-02 08:42:31 +02:00
syscalls	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal	2012-10-10 12:02:25 +09:00
tools	UAPI: x86: Fix the test_get_len tool	2012-10-02 18:01:56 +01:00
um	Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux	2012-10-14 13:39:34 -07:00
vdso	time: Convert x86_64 to using new update_vsyscall	2012-09-24 12:38:09 -04:00
video
xen	x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS.	2013-02-13 15:40:30 -05:00
.gitignore
Kbuild
Kconfig	Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux	2012-10-14 13:39:34 -07:00
Kconfig.cpu	x86/Kconfig: Clean up Kconfig defaults	2012-09-13 17:45:33 +02:00
Kconfig.debug	x86/tlb: add tlb_flushall_shift knob into debugfs	2012-06-27 19:29:10 -07:00
Makefile	kbuild: Fix accidental revert in commit fe04ddf	2012-10-15 13:01:05 -07:00
Makefile.um
Makefile_32.cpu