x86/speculation/mds: Revert CPU buffer clear on double fault exit
authorAndy Lutomirski <luto@kernel.org>
Tue, 14 May 2019 20:24:39 +0000 (13:24 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 21 May 2019 16:48:55 +0000 (18:48 +0200)
commit 88640e1dcd089879530a49a8d212d1814678dfe7 upstream.

The double fault ESPFIX path doesn't return to user mode at all --
it returns back to the kernel by simulating a #GP fault.
prepare_exit_to_usermode() will run on the way out of
general_protection before running user code.

Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Frederic Weisbecker <frederic@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jon Masters <jcm@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Fixes: 04dcbdb80578 ("x86/speculation/mds: Clear CPU buffers on exit to user")
Link: http://lkml.kernel.org/r/ac97612445c0a44ee10374f6ea79c222fe22a5c4.1557865329.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Documentation/x86/mds.rst
arch/x86/kernel/traps.c

index 534e9baa4e1d19bd53f4c7b62ce12c3735c2d89c..0dc812bb92492cdb9b002789a3a360701c6c95c9 100644 (file)
@@ -158,13 +158,6 @@ Mitigation points
      mitigated on the return from do_nmi() to provide almost complete
      coverage.
 
-   - Double fault (#DF):
-
-     A double fault is usually fatal, but the ESPFIX workaround, which can
-     be triggered from user space through modify_ldt(2) is a recoverable
-     double fault. #DF uses the paranoid exit path, so explicit mitigation
-     in the double fault handler is required.
-
    - Machine Check Exception (#MC):
 
      Another corner case is a #MC which hits between the CPU buffer clear
index ef225fa8e9286eebc55817bad1b6776ef99d4fa1..5bbfa2f63b8cd279e4a4ca5fbd963f6ade1bbef2 100644 (file)
@@ -62,7 +62,6 @@
 #include <asm/alternative.h>
 #include <asm/fpu/xstate.h>
 #include <asm/trace/mpx.h>
-#include <asm/nospec-branch.h>
 #include <asm/mpx.h>
 #include <asm/vm86.h>
 
@@ -341,13 +340,6 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
                regs->ip = (unsigned long)general_protection;
                regs->sp = (unsigned long)&normal_regs->orig_ax;
 
-               /*
-                * This situation can be triggered by userspace via
-                * modify_ldt(2) and the return does not take the regular
-                * user space exit, so a CPU buffer clear is required when
-                * MDS mitigation is enabled.
-                */
-               mds_user_clear_cpu_buffers();
                return;
        }
 #endif