d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

amd64: clear callee-preserved registers on syscall exit.

Browse Source 
%r8, %r10, and on non-KPTI configuration %r9 were not restored on fast
return from a syscall.

Reviewed by:	markj
Approved by:	so
Security:	CVE-2019-5595
Sponsored by:	The FreeBSD Foundation
MFC after:	0 minutes
This commit is contained in:
Konstantin Belousov 2019-02-05 17:49:27 +00:00
parent 78223db29c
commit 762138f78f
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/amd64/amd64/exception.S
View File

@ -521,12 +521,14 @@ fast_syscall_common:
movq TF_RFLAGS(%rsp),%r11 /* original %rflags */
movq TF_RIP(%rsp),%rcx /* original %rip */
movq TF_RSP(%rsp),%rsp /* user stack pointer */
xorl %r8d,%r8d /* zero the rest of GPRs */
xorl %r10d,%r10d
cmpq $~0,PCPU(UCR3)
je 2f
movq PCPU(UCR3),%r9
movq %r9,%cr3
xorl %r9d,%r9d
2: swapgs
2: xorl %r9d,%r9d
swapgs
sysretq
3: /* AST scheduled. */