linux/arch/x86_64
John Blackwood 97c2803c9c [PATCH] x86_64: Plug GS leak in arch_prctl()
In linux-2.6.16, we have noticed a problem where the gs base value
returned from an arch_prtcl(ARCH_GET_GS, ...) call will be incorrect if:

   - the current/calling task has NOT set its own gs base yet to a
     non-zero value,

   - some other task that ran on the same processor previously set their
     own gs base to a non-zero value.

In this situation, the ARCH_GET_GS code will read and return the
MSR_KERNEL_GS_BASE msr register.

However, since the __switch_to() code does NOT load/zero the
MSR_KERNEL_GS_BASE register when the task that is switched IN has a zero
next->gs value, the caller of arch_prctl(ARCH_GET_GS, ...) will get back
the value of some previous tasks's gs base value instead of 0.

    Change the arch_prctl() ARCH_GET_GS code to only read and return
    the MSR_KERNEL_GS_BASE msr register if the 'gs' register of the calling
    task is non-zero.

    Side note: Since in addition to using arch_prctl(ARCH_SET_GS, ...),
    a task can also setup a gs base value by using modify_ldt() and write
    an index value into 'gs' from user space, the patch below reads
    'gs' instead of using thread.gs, since in the modify_ldt() case,
    the thread.gs value will be 0, and incorrect value would be returned
    (the task->thread.gs value).

    When the user has not set its own gs base value and the 'gs'
    register is zero, then the MSR_KERNEL_GS_BASE register will not be
    read and a value of zero will be returned by reading and returning
    'task->thread.gs'.

    The first patch shown below is an attempt at implementing this
    approach.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-04-09 11:53:53 -07:00
..
boot [PATCH] x86: "make isoimage" support; FDINITRD= support; minor cleanups 2006-03-26 08:56:53 -08:00
crypto [CRYPTO] aes: Fixed array boundary violation 2006-03-21 20:14:10 +11:00
ia32 [PATCH] Mark unwind info for signal trampolines in vDSOs 2006-03-31 12:18:52 -08:00
kernel [PATCH] x86_64: Plug GS leak in arch_prctl() 2006-04-09 11:53:53 -07:00
lib [PATCH] x86_64: remove dead do_softirq_thunk 2006-03-25 09:10:53 -08:00
mm [PATCH] x86_64: Rename e820_mapped to e820_any_mapped 2006-04-09 11:53:17 -07:00
oprofile
pci [PATCH] i386/x86-64: Return defined error value for bad PCI config space accesses 2006-04-09 11:53:52 -07:00
defconfig [PATCH] x86_64: Update defconfig 2006-04-09 11:53:16 -07:00
Kconfig [PATCH] x86_64: Fixup read_mostly section on internode cache line size for vSMP 2006-04-09 11:53:52 -07:00
Kconfig.debug [PATCH] x86_64: Remove CONFIG_INIT_DEBUG 2006-02-04 16:43:13 -08:00
Makefile [PATCH] x86: "make isoimage" support; FDINITRD= support; minor cleanups 2006-03-26 08:56:53 -08:00