From 493fa112a845d9ea5d24d429b0142090758f941b Mon Sep 17 00:00:00 2001 From: Andi Kleen Date: Mon, 8 Jan 2007 22:44:07 +0100 Subject: x86_64: Don't leak NT bit into next task (CVE-2006-5755) SYSENTER can cause a NT to be set which might cause crashes on the IRET in the next task. Following similar i386 patch from Linus. Backport to 2.6.16 by Chuck Ebbert <76306.1226@compuserve.com> [Changed 'set_debugreg' to the older 'set_debug' in setup64.c and added raw_local_save_flags() from 2.6.19 to system.h] Signed-off-by: Andi Kleen Signed-off-by: Adrian Bunk --- arch/x86_64/kernel/entry.S | 4 ++++ arch/x86_64/kernel/setup64.c | 4 ++++ 2 files changed, 8 insertions(+) (limited to 'arch') diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S index 97583bb9122d..9111d55c3764 100644 --- a/arch/x86_64/kernel/entry.S +++ b/arch/x86_64/kernel/entry.S @@ -136,6 +136,10 @@ /* rdi: prev */ ENTRY(ret_from_fork) CFI_DEFAULT_STACK + push kernel_eflags(%rip) + CFI_ADJUST_CFA_OFFSET 4 + popf # reset kernel eflags + CFI_ADJUST_CFA_OFFSET -4 call schedule_tail GET_THREAD_INFO(%rcx) testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT),threadinfo_flags(%rcx) diff --git a/arch/x86_64/kernel/setup64.c b/arch/x86_64/kernel/setup64.c index 70f1bb808a20..07772c80cbff 100644 --- a/arch/x86_64/kernel/setup64.c +++ b/arch/x86_64/kernel/setup64.c @@ -178,6 +178,8 @@ void __cpuinit check_efer(void) } } +unsigned long kernel_eflags; + /* * cpu_init() initializes state that is per-CPU. Some data is already * initialized (naturally) in the bootstrap process, such as the GDT @@ -289,4 +291,6 @@ void __cpuinit cpu_init (void) set_debug(0UL, 7); fpu_init(); + + raw_local_save_flags(kernel_eflags); } -- cgit v1.2.3