[PATCH] x86/entry/32: Harden return-to-user

[Andrey Zakharov]

Commit 1e4d3001f59f ("x86/entry: Harden return-to-user") made the
check that the IRET frame returns to user mode unconditional on
x86-64. The 32-bit entry code has no equivalent: restore_all_switch_stack
executes IRET with whatever CS is in the frame. The exception return
path tests CS to choose between returning to the kernel and to user
mode, but the system call return paths (int $0x80, the SYSENTER
fallback and ret_from_fork) do not test it before reaching
restore_all_switch_stack.

Add an unconditional check to restore_all_switch_stack, after the
registers are restored. It requires that CS in the IRET frame has a
user RPL, or that EFLAGS.VM is set for vm86, and traps with UD2
otherwise. It is placed before CLEAR_CPU_BUFFERS so that the buffer
clearing stays directly in front of the IRET. The exception return
path to the kernel jumps straight to .Lirq_return and does not go
through the new check.

Testing: built i386_defconfig plus CONFIG_X86_LEGACY_VM86=y with
gcc 16.2.1; the build reported no warnings. Booted it under
QEMU (TCG, -cpu max) with a minimal initramfs running the
entry_from_vm86, sigreturn, single_step_syscall and syscall_nt
selftests. The results match the unpatched kernel, ignoring the FLAGS
values printed by entry_from_vm86, which also differ between two runs
of the unpatched kernel. entry_from_vm86 reports a UMIP failure on both
kernels. As negative controls, making the RPL test always fail kills
init with UD2 at the first return to user space, and removing the
EFLAGS.VM exception makes entry_from_vm86 hit the UD2.

Not tested: real hardware, performance, the NMI and double fault exits,
builds with PTI enabled, and builds with CONFIG_X86_LEGACY_VM86
disabled.

Link: https://github.com/KSPP/linux/issues/41
Signed-off-by: Andrey Zakharov <dedemorow@xxxxxxxxx>
---
 arch/x86/entry/entry_32.S | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 92c0b4a94e0a..69f754e5657c 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -952,6 +952,14 @@ restore_all_switch_stack:
 
 	/* Restore user state */
 	RESTORE_REGS pop=4			# skip orig_eax/error_code
+
+	/* Assert that the IRET frame returns to user mode or vm86. */
+	testb	$USER_SEGMENT_RPL_MASK, 4(%esp)
+	jnz	.Lreturn_to_user_ok
+	testl	$X86_EFLAGS_VM, 8(%esp)
+	jnz	.Lreturn_to_user_ok
+	ud2
+.Lreturn_to_user_ok:
 	CLEAR_CPU_BUFFERS
 .Lirq_return:
 	/*
-- 
2.56.0