Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a tiny race in setregs and linux_setregs. Between the moment we set

Browse Source 
pcb_flags to zero, and the moment cpu_segregs64_zero resets pcb_gs, we may
be preempted.

If this happens, and if the calling LWP was a 32bit thread, when switching
back to that LWP, the context switcher sees that PCB_COMPAT32 is not set in
pcb_flags and tries to perform a 64bit context switch; but pcb_gs contains
a 32bit GDT descriptor, and not a 64bit GS.base value. The wrmsr therefore
faults because the value is non-canonical, and this fault is fatal.

Rearrange the code so that the update of pcb_flags and pcb_gs/pcb_fs is non
interruptible. This fixes the problem, tested with a reproducer (which
therefore doesn't work anymore).

Likely fixes PR/53993.
This commit is contained in:
maxv 2019-03-24 13:15:42 +00:00
parent 1fecd7570b
commit 46e1422377
2 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/arch/amd64/amd64/machdep.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: machdep.c,v 1.327 2019/03/09 08:42:25 maxv Exp $ */
/* $NetBSD: machdep.c,v 1.328 2019/03/24 13:15:42 maxv Exp $ */
/*
* Copyright (c) 1996, 1997, 1998, 2000, 2006, 2007, 2008, 2011
@ -110,7 +110,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.327 2019/03/09 08:42:25 maxv Exp $");
__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.328 2019/03/24 13:15:42 maxv Exp $");
#include "opt_modular.h"
#include "opt_user_ldt.h"
@ -1371,17 +1371,18 @@ setregs(struct lwp *l, struct exec_package *pack, vaddr_t stack)
fpu_save_area_clear(l, pack->ep_osversion >= 699002600
? __NetBSD_NPXCW__ : __NetBSD_COMPAT_NPXCW__);
pcb->pcb_flags = 0;
x86_dbregs_clear(l);
kpreempt_disable();
pcb->pcb_flags = 0;
l->l_proc->p_flag &= ~PK_32;
l->l_md.md_flags = MDL_IRET;
cpu_segregs64_zero(l);
kpreempt_enable();
tf = l->l_md.md_regs;
tf->tf_ds = GSEL(GUDATA_SEL, SEL_UPL);
tf->tf_es = GSEL(GUDATA_SEL, SEL_UPL);
cpu_segregs64_zero(l);
tf->tf_rdi = 0;
tf->tf_rsi = 0;
tf->tf_rbp = 0;
@ -2198,12 +2199,12 @@ cpu_segregs64_zero(struct lwp *l)
struct pcb *pcb;
uint64_t zero = 0;
KASSERT(kpreempt_disabled());
KASSERT((l->l_proc->p_flag & PK_32) == 0);
KASSERT(l == curlwp);
pcb = lwp_getpcb(l);
kpreempt_disable();
tf->tf_fs = 0;
tf->tf_gs = 0;
setds(GSEL(GUDATA_SEL, SEL_UPL));
@ -2223,7 +2224,6 @@ cpu_segregs64_zero(struct lwp *l)
pcb->pcb_gs = 0;
update_descriptor(&curcpu()->ci_gdt[GUFS_SEL], &zero);
update_descriptor(&curcpu()->ci_gdt[GUGS_SEL], &zero);
kpreempt_enable();
}
/*

11
sys/compat/linux/arch/amd64/linux_machdep.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: linux_machdep.c,v 1.56 2018/01/01 08:03:43 maxv Exp $ */
/* $NetBSD: linux_machdep.c,v 1.57 2019/03/24 13:15:43 maxv Exp $ */
/*-
* Copyright (c) 2005 Emmanuel Dreyfus, all rights reserved.
@ -33,7 +33,7 @@
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.56 2018/01/01 08:03:43 maxv Exp $");
__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.57 2019/03/24 13:15:43 maxv Exp $");
#include <sys/param.h>
#include <sys/types.h>
@ -91,11 +91,13 @@ linux_setregs(struct lwp *l, struct exec_package *epp, vaddr_t stack)
#endif
fpu_save_area_clear(l, __NetBSD_NPXCW__);
kpreempt_disable();
pcb->pcb_flags = 0;
l->l_proc->p_flag &= ~PK_32;
l->l_md.md_flags = MDL_IRET;
cpu_segregs64_zero(l);
kpreempt_enable();
tf = l->l_md.md_regs;
tf->tf_rax = 0;
@ -120,7 +122,6 @@ linux_setregs(struct lwp *l, struct exec_package *epp, vaddr_t stack)
tf->tf_ss = GSEL(GUDATA_SEL, SEL_UPL);
tf->tf_ds = GSEL(GUDATA_SEL, SEL_UPL);
tf->tf_es = 0;
cpu_segregs64_zero(l);
return;
}