[src/netbsd-7-0]: src/sys/compat/linux/arch/amd64 Pull up following revision(...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/25247ed986f4
branches:  netbsd-7-0
changeset: 801283:25247ed986f4
user:      snj <snj%NetBSD.org@localhost>
date:      Tue Feb 14 16:55:27 2017 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #1359):
        sys/compat/linux/arch/amd64/linux_machdep.c: 1.50, 1.51
Don't let userland choose %rip. This is the Intel Sysret vulnerability
again.
--
Make sure %rip is in userland. This is harmless, since the return to
userland is made with iret instead of sysret in this path. While here, use
size_t.

diffstat:

 sys/compat/linux/arch/amd64/linux_machdep.c |  15 +++++++++++----
 1 files changed, 11 insertions(+), 4 deletions(-)

diffs (50 lines):

diff -r dea6e2c68cc1 -r 25247ed986f4 sys/compat/linux/arch/amd64/linux_machdep.c
--- a/sys/compat/linux/arch/amd64/linux_machdep.c       Sun Feb 12 22:03:49 2017 +0000
+++ b/sys/compat/linux/arch/amd64/linux_machdep.c       Tue Feb 14 16:55:27 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: linux_machdep.c,v 1.48 2014/02/19 20:50:56 dsl Exp $ */
+/*     $NetBSD: linux_machdep.c,v 1.48.8.1 2017/02/14 16:55:27 snj Exp $ */
 
 /*-
  * Copyright (c) 2005 Emmanuel Dreyfus, all rights reserved.
@@ -33,7 +33,7 @@
 
 #include <sys/cdefs.h>
 
-__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.48 2014/02/19 20:50:56 dsl Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.48.8.1 2017/02/14 16:55:27 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/types.h>
@@ -230,7 +230,12 @@
        if (error != 0) {
                sigexit(l, SIGILL);
                return;
-       }       
+       }
+
+       if ((vaddr_t)catcher >= VM_MAXUSER_ADDRESS) {
+               sigexit(l, SIGILL);
+               return;
+       }
 
        linux_buildcontext(l, catcher, sp);
        tf->tf_rdi = sigframe.info.lsi_signo;
@@ -448,7 +453,7 @@
 {
        struct trapframe *tf = arg;
        uint64_t retaddr;
-       int vsyscallnr;
+       size_t vsyscallnr;
 
        /*
         * Check for a vsyscall. %rip must be the fault address,
@@ -478,6 +483,8 @@
         */
        if (copyin((void *)tf->tf_rsp, &retaddr, sizeof retaddr) != 0)
                return 0;
+       if ((vaddr_t)retaddr >= VM_MAXUSER_ADDRESS)
+               return 0;
        tf->tf_rip = retaddr;
        tf->tf_rax = linux_vsyscall_to_syscall[vsyscallnr];
        tf->tf_rsp += 8;        /* "pop" the return address */