Commit 48a2440d authored by Pawan Gupta's avatar Pawan Gupta Committed by Dave Hansen
Browse files

x86/entry_32: Clear CPU buffers after register restore in NMI return 



CPU buffers are currently cleared after call to exc_nmi, but before
register state is restored. This may be okay for MDS mitigation but not for
RDFS. Because RDFS mitigation requires CPU buffers to be cleared when
registers don't have any sensitive data.

Move CLEAR_CPU_BUFFERS after RESTORE_ALL_NMI.

Fixes: a0e2dab4 ("x86/entry_32: Add VERW just before userspace transition")
Suggested-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: default avatarPawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Cc:stable@vger.kernel.org
Link: https://lore.kernel.org/all/20240925-fix-dosemu-vm86-v7-2-1de0daca2d42%40linux.intel.com
parent 2e2e5143

arch/x86/entry/entry_32.S

+2 −1
Original line number Diff line number Diff line
@@ -1145,7 +1145,6 @@ SYM_CODE_START(asm_exc_nmi) 


	/* Not on SYSENTER stack. */

	call	exc_nmi

	CLEAR_CPU_BUFFERS

	jmp	.Lnmi_return



.Lnmi_from_sysenter_stack:
@@ -1166,6 +1165,7 @@ SYM_CODE_START(asm_exc_nmi) 


	CHECK_AND_APPLY_ESPFIX

	RESTORE_ALL_NMI cr3_reg=%edi pop=4

	CLEAR_CPU_BUFFERS

	jmp	.Lirq_return



#ifdef CONFIG_X86_ESPFIX32
@@ -1207,6 +1207,7 @@ SYM_CODE_START(asm_exc_nmi) 
	 *  1 - orig_ax

	 */

	lss	(1+5+6)*4(%esp), %esp			# back to espfix stack

	CLEAR_CPU_BUFFERS

	jmp	.Lirq_return

#endif

SYM_CODE_END(asm_exc_nmi)