Re: DO NOT APPLY: x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack

[Andrew Lutomirski]

On Tue, Jul 15, 2014 at 4:52 PM, Greg KH <greg@xxxxxxxxx> wrote:
> On Tue, Jul 15, 2014 at 04:21:46PM -0700, Andrew Lutomirski wrote:
>> On Tue, Jul 15, 2014 at 2:28 PM, Kamal Mostafa <kamal@xxxxxxxxxxxxx> wrote:
>> > 3.13.11.5 -stable review patch.  If anyone has any objections, please let me know.
>> >
>> > ------------------
>> >
>> > From: "H. Peter Anvin" <hpa@xxxxxxxxxxxxxxx>
>> >
>> > commit 3891a04aafd668686239349ea58f3314ea2af86b upstream.
>>
>> Do not apply to any -stable release yet.  This causes nasty regressions on Xen.
>
> I thought you all found the Xen-regression-fix patch a few hours ago,
> right?

That patch is insufficient: Xen guests still fail to initialize
espfix64 correctly on SMP.  It's currently unclear that espfix64 can
work at all on Xen -- it's may be rather fundamentally incompatible
with the Xen hypercall IRET mechanism.  So it might need to be
disabled entirely on Xen (and maybe Xen will fix the info leak in the
hypervisor).

>
> This means that Linus's tree is also broken?

Yes.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/