From 233c4586f66e37a52a5e521d256aa55fa138a6c0 Mon Sep 17 00:00:00 2001 From: Konrad Rzeszutek Wilk Date: Sat, 6 Jan 2018 23:53:40 -0500 Subject: [PATCH] x86: Don't ENABLE_IBRS in nmi when we are still running on user cr3 It won't end well - especially as we need to be careful about touching kernel variables and can only do that in the kernel cr3. The code: movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp may lead one to believe you can access kernel variables, but in fact we haven't yet switched over the kernel cr3. Orabug: 27344012 CVE: CVE-2017-5715 Reported-by: Boris Ostrovsky Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Kirtikar Kashyap --- arch/x86/kernel/entry_64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S index 40970c5403b8..d2684f7bd8d9 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -1717,7 +1717,6 @@ ENTRY(nmi) cld movq %rsp, %rdx movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp - ENABLE_IBRS pushq 5*8(%rdx) /* pt_regs->ss */ pushq 4*8(%rdx) /* pt_regs->rsp */ pushq 3*8(%rdx) /* pt_regs->flags */ @@ -1759,6 +1758,7 @@ ENTRY(nmi) movq %rax, %cr3 2: #endif + ENABLE_IBRS call do_nmi DISABLE_IBRS #ifdef CONFIG_PAGE_TABLE_ISOLATION -- 2.50.1