]> err.no Git - linux-2.6/commit
[PATCH] x86_64: When user could have changed RIP always force IRET
authorAndi Kleen <ak@suse.de>
Fri, 7 Apr 2006 17:50:00 +0000 (19:50 +0200)
committerLinus Torvalds <torvalds@g5.osdl.org>
Sun, 9 Apr 2006 18:53:52 +0000 (11:53 -0700)
commit7bf36bbc5e0c09271f9efe22162f8cc3f8ebd3d2
tree9e97e2f5774824f0e2fbff1d4e7c49e9938285f5
parent553f265fe883a23502ee351845f09334790f18b8
[PATCH] x86_64: When user could have changed RIP always force IRET

Intel EM64T CPUs handle uncanonical return addresses differently
from AMD CPUs.

The exception is reported in the SYSRET, not the next instruction.
This leads to the kernel exception handler running on the user stack
with the wrong GS because the kernel didn't expect exceptions
on this instruction.

This version of the patch has the teething problems that plagued an earlier
version fixed.

This is CVE-2006-0744

Thanks to Ernie Petrides and Asit B. Mallick for analysis and initial
patches.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
arch/x86_64/kernel/entry.S