summaryrefslogtreecommitdiff
path: root/drivers/hsi
diff options
context:
space:
mode:
authorAndy Lutomirski <luto@amacapital.net>2014-10-31 18:08:45 -0700
committerJiri Slaby <jslaby@suse.cz>2014-11-15 13:27:31 +0100
commit2854d767135c3ca131d8658f5b47974d7b067d3b (patch)
treed183d847c56bda94405c08449594da7575ef6ff7 /drivers/hsi
parent2edb76f37c9f8e3081c5b5619c51f8f291819531 (diff)
x86_64, entry: Fix out of bounds read on sysenter
commit 653bc77af60911ead1f423e588f54fc2547c4957 upstream. Rusty noticed a Really Bad Bug (tm) in my NT fix. The entry code reads out of bounds, causing the NT fix to be unreliable. But, and this is much, much worse, if your stack is somehow just below the top of the direct map (or a hole), you read out of bounds and crash. Excerpt from the crash: [ 1.129513] RSP: 0018:ffff88001da4bf88 EFLAGS: 00010296 2b:* f7 84 24 90 00 00 00 testl $0x4000,0x90(%rsp) That read is deterministically above the top of the stack. I thought I even single-stepped through this code when I wrote it to check the offset, but I clearly screwed it up. Fixes: 8c7aa698baca ("x86_64, entry: Filter RFLAGS.NT on entry from userspace") Reported-by: Rusty Russell <rusty@ozlabs.org> Cc: stable@vger.kernel.org Signed-off-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'drivers/hsi')
0 files changed, 0 insertions, 0 deletions