x86/asm/entry: Clear EXTRA_REGS for all executable formats

On failure, sys_execve() does not clobber EXTRA_REGS, so we can
just return to userpsace without saving/restoring them.

On success, ELF_PLAT_INIT() in sys_execve() clears all these
registers.

On other executable formats:

  - binfmt_flat.c has similar FLAT_PLAT_INIT, but x86 (and everyone
    else except sh) doesn't define it.

  - binfmt_elf_fdpic.c has ELF_FDPIC_PLAT_INIT, but x86 (and most
    others) doesn't define it.

  - There are no such hooks in binfmt_aout.c et al. We inherit
    EXTRA_REGS from the prior executable.

This inconsistency was not intended.

This change removes SAVE/RESTORE_EXTRA_REGS in stub_execve,
removes register clearing in ELF_PLAT_INIT(),
and instead simply clears them on success in stub_execve.

Run-tested.

Signed-off-by: Denys Vlasenko <[email protected]>
Cc: Alexei Starovoitov <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Frederic Weisbecker <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Steven Rostedt <[email protected]>
Cc: Will Drewry <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

diff --git a/arch/x86/include/asm/calling.h b/arch/x86/include/asm/calling.h
index 4b5f7bf2b7809575646ed47012e84c4276785e6f..1c8b50edb2db3cac8f54c0c300d393b18bf24342 100644 (file)
--- a/arch/x86/include/asm/calling.h
+++ b/arch/x86/include/asm/calling.h
@@ -151,6 +151,15 @@ For 32-bit we have the following conventions - kernel is built with
        movq_cfi_restore 5*8+\offset, rbx
        .endm
 
+       .macro ZERO_EXTRA_REGS
+       xorl    %r15d, %r15d
+       xorl    %r14d, %r14d
+       xorl    %r13d, %r13d
+       xorl    %r12d, %r12d
+       xorl    %ebp, %ebp
+       xorl    %ebx, %ebx
+       .endm
+
        .macro RESTORE_C_REGS_HELPER rstor_rax=1, rstor_rcx=1, rstor_r11=1, rstor_r8910=1, rstor_rdx=1
        .if \rstor_r11
        movq_cfi_restore 6*8, r11

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index ca3347a9dab5211399e9e93a5e53d71ca1943095..3563107b50601d7eb11e767340c7c25aa87b32dd 100644 (file)
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -171,10 +171,11 @@ do {                                              \
 static inline void elf_common_init(struct thread_struct *t,
                                   struct pt_regs *regs, const u16 ds)
 {
-       regs->ax = regs->bx = regs->cx = regs->dx = 0;
-       regs->si = regs->di = regs->bp = 0;
+       /* Commented-out registers are cleared in stub_execve */
+       /*regs->ax = regs->bx =*/ regs->cx = regs->dx = 0;
+       regs->si = regs->di /*= regs->bp*/ = 0;
        regs->r8 = regs->r9 = regs->r10 = regs->r11 = 0;
-       regs->r12 = regs->r13 = regs->r14 = regs->r15 = 0;
+       /*regs->r12 = regs->r13 = regs->r14 = regs->r15 = 0;*/
        t->fs = t->gs = 0;
        t->fsindex = t->gsindex = 0;
        t->ds = t->es = ds;

diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 386375d43d147debdbd90a0d8e3c2b9325754fd6..f4270ff73f2ab748e0c3dfd14c5f8d76dd830ca2 100644 (file)
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -419,25 +419,27 @@ END(stub_\func)
 
 ENTRY(stub_execve)
        CFI_STARTPROC
-       addq $8, %rsp
-       DEFAULT_FRAME 0
-       SAVE_EXTRA_REGS
-       call sys_execve
-       movq %rax,RAX(%rsp)
-       RESTORE_EXTRA_REGS
-       jmp int_ret_from_sys_call
+       DEFAULT_FRAME 0, 8
+       call    sys_execve
+return_from_execve:
+       testl   %eax, %eax
+       jz      1f
+       /* exec failed, can use fast SYSRET code path in this case */
+       ret
+1:
+       /* must use IRET code path (pt_regs->cs may have changed) */
+       addq    $8, %rsp
+       ZERO_EXTRA_REGS
+       movq    %rax,RAX(%rsp)
+       jmp     int_ret_from_sys_call
        CFI_ENDPROC
 END(stub_execve)
 
 ENTRY(stub_execveat)
        CFI_STARTPROC
-       addq $8, %rsp
-       DEFAULT_FRAME 0
-       SAVE_EXTRA_REGS
-       call sys_execveat
-       movq %rax,RAX(%rsp)
-       RESTORE_EXTRA_REGS
-       jmp int_ret_from_sys_call
+       DEFAULT_FRAME 0, 8
+       call    sys_execveat
+       jmp     return_from_execve
        CFI_ENDPROC
 END(stub_execveat)
 
@@ -472,25 +474,17 @@ END(stub_x32_rt_sigreturn)
 
 ENTRY(stub_x32_execve)
        CFI_STARTPROC
-       addq $8, %rsp
-       DEFAULT_FRAME 0
-       SAVE_EXTRA_REGS
-       call compat_sys_execve
-       movq %rax,RAX(%rsp)
-       RESTORE_EXTRA_REGS
-       jmp int_ret_from_sys_call
+       DEFAULT_FRAME 0, 8
+       call    compat_sys_execve
+       jmp     return_from_execve
        CFI_ENDPROC
 END(stub_x32_execve)
 
 ENTRY(stub_x32_execveat)
        CFI_STARTPROC
-       addq $8, %rsp
-       DEFAULT_FRAME 0
-       SAVE_EXTRA_REGS
-       call compat_sys_execveat
-       movq %rax,RAX(%rsp)
-       RESTORE_EXTRA_REGS
-       jmp int_ret_from_sys_call
+       DEFAULT_FRAME 0, 8
+       call    compat_sys_execveat
+       jmp     return_from_execve
        CFI_ENDPROC
 END(stub_x32_execveat)