leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3b920cef34
linux/arch/i386/kernel
History
Andi Kleen 18bd057b14 [PATCH] i386/x86-64: Fix x87 information leak between processes 
AMD K7/K8 CPUs only save/restore the FOP/FIP/FDP x87 registers in FXSAVE
when an exception is pending.  This means the value leak through
context switches and allow processes to observe some x87 instruction
state of other processes.

This was actually documented by AMD, but nobody recognized it as
being different from Intel before.

The fix first adds an optimization: instead of unconditionally
calling FNCLEX after each FXSAVE test if ES is pending and skip
it when not needed. Then do a x87 load from a kernel variable to
clear FOP/FIP/FDP.

This means other processes always will only see a constant value
defined by the kernel in their FP state.

I took some pain to make sure to chose a variable that's already
in L1 during context switch to make the overhead of this low.

Also alternative() is used to patch away the new code on CPUs
who don't need it.

Patch for both i386/x86-64.

The problem was discovered originally by Jan Beulich. Richard
Brunner provided the basic code for the workarounds, with contribution
from Jan.

This is CVE-2006-1056

Cc: richard.brunner@amd.com
Cc: jbeulich@novell.com

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-04-20 07:58:11 -07:00
..
acpi [PATCH] i386/x86-64: Fix ACPI disabled LAPIC handling mismerge 2006-04-18 10:39:19 -07:00
cpu [PATCH] i386/x86-64: Fix x87 information leak between processes 2006-04-20 07:58:11 -07:00
timers [PATCH] PM-Timer: don't use workaround if chipset is not buggy 2006-03-27 08:44:37 -08:00
.gitignore [PATCH] x86: gitignore some autogenerated files for i386 2006-02-14 16:09:35 -08:00
alternative.c [PATCH] x86: SMP alternatives 2006-03-23 07:38:04 -08:00
apic.c [PATCH] i386: Consolidate modern APIC handling 2006-04-09 11:53:51 -07:00
apm.c [PATCH] apm: fix Armada laptops again 2006-04-19 09:13:52 -07:00
asm-offsets.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
bootflag.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
cpuid.c [PATCH] x86 cpuid and msr notifier callback section mismatches 2006-04-19 09:13:50 -07:00
crash_dump.c [PATCH] kdump: read previous kernel's memory 2006-01-10 08:01:28 -08:00
crash.c kexec: grammar fix for crash_save_this_cpu() 2006-04-01 01:39:17 +02:00
doublefault.c [PATCH] i386: inline assembler: cleanup and encapsulate descriptor and task register management 2005-09-05 00:06:11 -07:00
early_printk.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
efi_stub.S Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
efi.c [PATCH] fix array overrun in efi.c 2006-03-26 08:56:57 -08:00
entry.S [PATCH] i386: fix singlestep through an int80 syscall 2006-03-23 07:38:05 -08:00
head.S [PATCH] i386: cleanup after cpu_gdt_descr conversion to per-cpu data 2006-03-23 07:38:06 -08:00
i386_ksyms.c [PATCH] No arch-specific strpbrk implementations 2006-04-11 06:18:40 -07:00
i387.c x86: make restore_fpu() use alternative assembler instructions 2005-07-22 16:06:16 -04:00
i8237.c [PATCH] ISA DMA suspend for i386 2005-09-05 00:06:14 -07:00
i8259.c Revert "i386: move apic init in init_IRQs" 2005-10-31 19:16:17 -08:00
init_task.c [PATCH] Change maxaligned_in_smp alignemnt macros to internodealigned_in_smp macros 2006-01-08 20:13:38 -08:00
io_apic.c [PATCH] Don't pass boot parameters to argv_init[] 2006-03-31 12:18:53 -08:00
ioport.c [PATCH] capable/capability.h (arch/) 2006-01-11 18:42:14 -08:00
irq.c [PATCH] Change maxaligned_in_smp alignemnt macros to internodealigned_in_smp macros 2006-01-08 20:13:38 -08:00
kprobes.c [PATCH] Switch Kprobes inline functions to __kprobes for i386 2006-04-19 09:13:52 -07:00
ldt.c [PATCH] arch/i386/kernel/ldt.c should #include <asm/mmu_context.h> 2005-11-07 07:53:29 -08:00
machine_kexec.c [PATCH] fix kexec asm 2006-03-08 14:15:04 -08:00
Makefile [PATCH] DMI: move dmi_scan.c from arch/i386 to drivers/firmware/ 2006-04-14 11:41:25 -07:00
mca.c [PATCH] arch/i386: Use ARRAY_SIZE macro 2005-11-07 07:53:28 -08:00
microcode.c [PATCH] arch/i386/kernel/microcode.c: remove the obsolete microcode_ioctl 2006-03-28 09:16:06 -08:00
module.c [PATCH] x86: SMP alternatives 2006-03-23 07:38:04 -08:00
mpparse.c [PATCH] mpparse: prevent table index out-of-bounds 2006-04-11 06:18:34 -07:00
msr.c [PATCH] x86 cpuid and msr notifier callback section mismatches 2006-04-19 09:13:50 -07:00
nmi.c [PATCH] fix signed vs unsigned in nmi watchdog 2006-03-28 09:16:08 -08:00
numaq.c [PATCH] re-disable TSC on NUMAQ 2005-07-28 21:46:05 -07:00
pci-dma.c [PATCH] gfp flags annotations - part 1 2005-10-08 15:00:57 -07:00
process.c [PATCH] unexport get_wchan 2006-03-31 12:19:01 -08:00
ptrace.c [PATCH] i386: Don't let ptrace set the nested task bit 2006-03-23 07:38:04 -08:00
quirks.c [PATCH] EDAC: core EDAC support code 2006-01-18 19:20:31 -08:00
reboot_fixups.c [PATCH] i386: Remove printk about reboot fixups at reboot 2006-04-09 11:53:53 -07:00
reboot.c [PATCH] i386/x86-64: Don't IPI to offline cpus on shutdown 2006-01-11 19:04:50 -08:00
relocate_kernel.S [PATCH] kexec: x86 kexec core 2005-06-25 16:24:49 -07:00
scx200.c [PATCH] arch: Replace pci_module_init() with pci_register_driver() 2006-01-09 12:13:21 -08:00
semaphore.c [PATCH] x86: SMP alternatives 2006-03-23 07:38:04 -08:00
setup.c Move request_standard_resources() back to before PCI probing 2006-04-09 12:14:02 -07:00
sigframe.h [PATCH] __user annotations for pointers in i386 sigframe 2005-09-09 10:31:59 -07:00
signal.c [PATCH] swsusp: finally solve mysqld problem 2006-03-23 07:38:08 -08:00
smp.c [PATCH] on_each_cpu(): disable local interrupts 2006-03-22 07:53:59 -08:00
smpboot.c [PATCH] sched: new sched domain for representing multi-core 2006-03-27 08:44:43 -08:00
srat.c [PATCH] x86_64: Make i386 compile again with fourth DMA32 zone 2005-11-14 19:55:13 -08:00
summit.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sys_i386.c [PATCH] Uninline sys_mmap common code (reduce binary size) 2006-03-22 07:54:02 -08:00
syscall_table.S [PATCH] splice: add support for sys_tee() 2006-04-11 15:51:17 +02:00
sysenter.c [PATCH] sep initializing rework 2005-06-25 16:24:29 -07:00
time_hpet.c [PATCH] move rtc_interrupt() prototype to rtc.h 2006-01-08 20:13:47 -08:00
time.c [PATCH] x86: fix potential jiffies overflow in timer_resume() 2006-03-06 18:40:44 -08:00
topology.c [PATCH] x86 topology: don;t create a control file for BSP that cannot be removed 2006-03-23 07:38:07 -08:00
trampoline.S Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
traps.c [PATCH] i386: print EIP/ESP last 2006-04-11 06:18:33 -07:00
vm86.c [PATCH] make vm86 call audit_syscall_exit 2006-03-20 14:08:53 -05:00
vmlinux.lds.S Merge master.kernel.org:/pub/scm/linux/kernel/git/sam/kbuild 2006-03-25 08:48:48 -08:00
vsyscall-int80.S Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
vsyscall-note.S [PATCH] i386 vDSO: add PT_NOTE segment 2005-04-16 15:24:48 -07:00
vsyscall-sigreturn.S [PATCH] Mark unwind info for signal trampolines in vDSOs 2006-03-31 12:18:52 -08:00
vsyscall-sysenter.S [PATCH] i386: more vsyscall documentation 2006-03-23 07:38:06 -08:00
vsyscall.lds.S kbuild: full dependency check on asm-offsets.h 2005-09-09 19:28:28 +02:00
vsyscall.S Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00