From: Mihai Carabas Date: Fri, 18 May 2018 09:42:44 +0000 (+0300) Subject: x86: thread_info.h: move RDS from index 5 to 23 X-Git-Tag: v4.1.12-124.31.3~765 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=caa8c564e0623d57622a4610852087b1fb6f29aa;p=users%2Fjedix%2Flinux-maple.git x86: thread_info.h: move RDS from index 5 to 23 In UEK4, the thread flags field is split in two parts: - lower bits of the word which are used usually for "pending work-to-be-done" - upper bits of the word There is a comment in arch/x86/include/asm/thread_info.h:88 where it says that the lower bits are hard-coded in entry_64.S. In entry_64.S a mask of 0x0000ffff is used to check the state of the thread and determine if it would go to userspace or not. Because we used bit "5", which was in the lower bits part, one of the checked condition was always true and the program never returned from kernel. We moved RDS to bit 23 which was free to solve the issue. OraBug: 28041771 CVE: CVE-2018-3639 Signed-off-by: Mihai Carabas Reviewed-by: Konrad Rzeszutek Wilk Signed-off-by: Brian Maly --- diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h index abe850f8fc23..8532f2fc846c 100644 --- a/arch/x86/include/asm/thread_info.h +++ b/arch/x86/include/asm/thread_info.h @@ -92,7 +92,6 @@ struct thread_info { #define TIF_SIGPENDING 2 /* signal pending */ #define TIF_NEED_RESCHED 3 /* rescheduling necessary */ #define TIF_SINGLESTEP 4 /* reenable singlestep on user return*/ -#define TIF_RDS 5 /* Reduced data speculation */ #define TIF_SYSCALL_EMU 6 /* syscall emulation active */ #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */ #define TIF_SECCOMP 8 /* secure computing */ @@ -105,6 +104,7 @@ struct thread_info { #define TIF_MEMDIE 20 /* is terminating due to OOM killer */ #define TIF_POLLING_NRFLAG 21 /* idle is polling for TIF_NEED_RESCHED */ #define TIF_IO_BITMAP 22 /* uses I/O bitmap */ +#define TIF_RDS 23 /* Reduced data speculation */ #define TIF_FORCED_TF 24 /* true if TF in eflags artificially */ #define TIF_BLOCKSTEP 25 /* set when we want DEBUGCTLMSR_BTF */ #define TIF_FREEZE 26 /* is freezing for suspend */ @@ -117,7 +117,6 @@ struct thread_info { #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME) #define _TIF_SIGPENDING (1 << TIF_SIGPENDING) #define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP) -#define _TIF_RDS (1 << TIF_RDS) #define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED) #define _TIF_SYSCALL_EMU (1 << TIF_SYSCALL_EMU) #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT) @@ -130,6 +129,7 @@ struct thread_info { #define _TIF_NOHZ (1 << TIF_NOHZ) #define _TIF_POLLING_NRFLAG (1 << TIF_POLLING_NRFLAG) #define _TIF_IO_BITMAP (1 << TIF_IO_BITMAP) +#define _TIF_RDS (1 << TIF_RDS) #define _TIF_FORCED_TF (1 << TIF_FORCED_TF) #define _TIF_BLOCKSTEP (1 << TIF_BLOCKSTEP) #define _TIF_LAZY_MMU_UPDATES (1 << TIF_LAZY_MMU_UPDATES)