From 3cdc87ea01fc2d12e6c16d27520d7554cf07dc8e Mon Sep 17 00:00:00 2001
From: emaste <emaste@FreeBSD.org>
Date: Tue, 5 Feb 2019 18:07:45 +0000
Subject: amd64: clear callee-preserved registers on syscall exit

Submitted by:	kib
Approved by:	so
Security:	CVE-2019-5595
Security:	FreeBSD-SA-19:01.syscall
---
 sys/amd64/amd64/exception.S | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/amd64/amd64/exception.S b/sys/amd64/amd64/exception.S
index b7e88e6..c35cea9 100644
--- a/sys/amd64/amd64/exception.S
+++ b/sys/amd64/amd64/exception.S
@@ -496,12 +496,14 @@ fast_syscall_common:
 	movq	TF_RFLAGS(%rsp),%r11	/* original %rflags */
 	movq	TF_RIP(%rsp),%rcx	/* original %rip */
 	movq	TF_RSP(%rsp),%rsp	/* user stack pointer */
+	xorl	%r8d,%r8d		/* zero the rest of GPRs */
+	xorl	%r10d,%r10d
 	cmpb	$0,pti
 	je	2f
 	movq	PCPU(UCR3),%r9
 	movq	%r9,%cr3
-	xorl	%r9d,%r9d
-2:	swapgs
+2:	xorl	%r9d,%r9d
+	swapgs
 	sysretq
 
 3:	/* AST scheduled. */
-- 
cgit v1.1


From fa113e14a11a28421ac7613ac726034e329e1133 Mon Sep 17 00:00:00 2001
From: emaste <emaste@FreeBSD.org>
Date: Tue, 5 Feb 2019 18:22:21 +0000
Subject: UPDATING and newvers entries for 11.2-p9

Approved by:	so
Security:	FreeBSD-SA-19:01.syscall
---
 UPDATING            | 5 +++++
 sys/conf/newvers.sh | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/UPDATING b/UPDATING
index 3a44e6c..6e159f8 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,11 @@ from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to
 the tip of head, and then rebuild without this option. The bootstrap process
 from older version of current across the gcc/clang cutover is a bit fragile.
 
+20190205	p9	FreeBSD-SA-19:01.syscall
+
+	amd64: clear callee-preserved registers on syscall exit
+							[SA-19:01.syscall]
+
 20190109	p8	FreeBSD-EN-19:03.sqlite
 			FreeBSD-EN-19:04.tzdata
 			FreeBSD-EN-19:05.kqueue
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 041b548..5da6827 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -44,7 +44,7 @@
 
 TYPE="FreeBSD"
 REVISION="11.2"
-BRANCH="RELEASE-p8"
+BRANCH="RELEASE-p9"
 if [ -n "${BRANCH_OVERRIDE}" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi
-- 
cgit v1.1