From patchwork Tue Feb 1 16:52:15 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 81334 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 7F9F7B70E9 for ; Wed, 2 Feb 2011 03:52:59 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1PkJTL-0003RV-Mm; Tue, 01 Feb 2011 16:52:55 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1PkJSn-0003E9-Sj for kernel-team@lists.ubuntu.com; Tue, 01 Feb 2011 16:52:21 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1PkJSn-0001rn-Bb; Tue, 01 Feb 2011 16:52:21 +0000 Received: from [85.210.144.187] (helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1PkJSn-0003Da-5e; Tue, 01 Feb 2011 16:52:21 +0000 From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [dapper CVE 1/1] x86: replace LOCK_PREFIX in futex.h Date: Tue, 1 Feb 2011 16:52:15 +0000 Message-Id: <1296579135-768-2-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1296579135-768-1-git-send-email-apw@canonical.com> References: <1296579135-768-1-git-send-email-apw@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Thomas Gleixner The exception fixup for the futex macros __futex_atomic_op1/2 and futex_atomic_cmpxchg_inatomic() is missing an entry when the lock prefix is replaced by a NOP via SMP alternatives. Chuck Ebert tracked this down from the information provided in: https://bugzilla.redhat.com/show_bug.cgi?id=429412 A possible solution would be to add another fixup after the LOCK_PREFIX, so both the LOCK and NOP case have their own entry in the exception table, but it's not really worth the trouble. Simply replace LOCK_PREFIX with lock and keep those untouched by SMP alternatives. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar [cebbert@redhat.com: backport to 2.6.24] Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman Signed-off-by: Stefan Bader CVE-2010-3086 BugLink: http://bugs.launchpad.net/bugs/706060 (backported from commit 9d55b9923a1b7ea8193b8875c57ec940dc2ff027 upstream) Signed-off-by: Andy Whitcroft Acked-by: Tim Gardner Acked-by: Stefan Bader --- include/asm-i386/futex.h | 4 ++-- include/asm-x86_64/futex.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/include/asm-i386/futex.h b/include/asm-i386/futex.h index e7a271d..33b574d 100644 --- a/include/asm-i386/futex.h +++ b/include/asm-i386/futex.h @@ -28,7 +28,7 @@ "1: movl %2, %0\n\ movl %0, %3\n" \ insn "\n" \ -"2: " LOCK_PREFIX "cmpxchgl %3, %2\n\ +"2: lock ; cmpxchgl %3, %2\n\ jnz 1b\n\ 3: .section .fixup,\"ax\"\n\ 4: mov %5, %1\n\ @@ -68,7 +68,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr) #endif switch (op) { case FUTEX_OP_ADD: - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, + __futex_atomic_op1("lock ; xaddl %0, %2", ret, oldval, uaddr, oparg); break; case FUTEX_OP_OR: diff --git a/include/asm-x86_64/futex.h b/include/asm-x86_64/futex.h index 8602c09..d74be2a 100644 --- a/include/asm-x86_64/futex.h +++ b/include/asm-x86_64/futex.h @@ -27,7 +27,7 @@ "1: movl %2, %0\n\ movl %0, %3\n" \ insn "\n" \ -"2: " LOCK_PREFIX "cmpxchgl %3, %2\n\ +"2: lock ; cmpxchgl %3, %2\n\ jnz 1b\n\ 3: .section .fixup,\"ax\"\n\ 4: mov %5, %1\n\ @@ -62,7 +62,7 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr) __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg); break; case FUTEX_OP_ADD: - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval, + __futex_atomic_op1("lock ; xaddl %0, %2", ret, oldval, uaddr, oparg); break; case FUTEX_OP_OR: