diff options
| author | Lai Jiangshan <jiangshan.ljs@antgroup.com> | 2022-04-12 20:49:08 +0800 |
|---|---|---|
| committer | Borislav Petkov <bp@suse.de> | 2022-05-19 10:56:46 +0200 |
| commit | 47f33de4aafb2f5e43d480d590a939d0f1d566a9 (patch) | |
| tree | c6b66cbc91c6b6438bac5fb53b9f0ff98af1ad18 /arch/x86/entry | |
| parent | c42b145181aafd59ed31ccd879493389e3ea5a08 (diff) | |
| download | linux-47f33de4aafb2f5e43d480d590a939d0f1d566a9.tar.gz linux-47f33de4aafb2f5e43d480d590a939d0f1d566a9.tar.bz2 linux-47f33de4aafb2f5e43d480d590a939d0f1d566a9.zip | |
x86/sev: Mark the code returning to user space as syscall gap
When returning to user space, %rsp is user-controlled value.
If it is a SNP-guest and the hypervisor decides to mess with the
code-page for this path while a CPU is executing it, a potential #VC
could hit in the syscall return path and mislead the #VC handler.
So make ip_within_syscall_gap() return true in this case.
Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Joerg Roedel <jroedel@suse.de>
Link: https://lore.kernel.org/r/20220412124909.10467-1-jiangshanlai@gmail.com
Diffstat (limited to 'arch/x86/entry')
| -rw-r--r-- | arch/x86/entry/entry_64.S | 2 | ||||
| -rw-r--r-- | arch/x86/entry/entry_64_compat.S | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index f7bd8001bf07..2fd8a5cad853 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -215,8 +215,10 @@ syscall_return_via_sysret: popq %rdi popq %rsp +SYM_INNER_LABEL(entry_SYSRETQ_unsafe_stack, SYM_L_GLOBAL) swapgs sysretq +SYM_INNER_LABEL(entry_SYSRETQ_end, SYM_L_GLOBAL) SYM_CODE_END(entry_SYSCALL_64) /* diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S index 4fdb007cddbd..3c0e14960e2b 100644 --- a/arch/x86/entry/entry_64_compat.S +++ b/arch/x86/entry/entry_64_compat.S @@ -297,6 +297,7 @@ sysret32_from_system_call: * code. We zero R8-R10 to avoid info leaks. */ movq RSP-ORIG_RAX(%rsp), %rsp +SYM_INNER_LABEL(entry_SYSRETL_compat_unsafe_stack, SYM_L_GLOBAL) /* * The original userspace %rsp (RSP-ORIG_RAX(%rsp)) is stored @@ -314,6 +315,7 @@ sysret32_from_system_call: xorl %r10d, %r10d swapgs sysretl +SYM_INNER_LABEL(entry_SYSRETL_compat_end, SYM_L_GLOBAL) SYM_CODE_END(entry_SYSCALL_compat) /* |