Module Name: src
Committed By: maxv
Date: Sun Mar 24 13:15:43 UTC 2019
Modified Files:
src/sys/arch/amd64/amd64: machdep.c
src/sys/compat/linux/arch/amd64: linux_machdep.c
Log Message:
Fix a tiny race in setregs and linux_setregs. Between the moment we set
pcb_flags to zero, and the moment cpu_segregs64_zero resets pcb_gs, we may
be preempted.
If this happens, and if the calling LWP was a 32bit thread, when switching
back to that LWP, the context switcher sees that PCB_COMPAT32 is not set in
pcb_flags and tries to perform a 64bit context switch; but pcb_gs contains
a 32bit GDT descriptor, and not a 64bit GS.base value. The wrmsr therefore
faults because the value is non-canonical, and this fault is fatal.
Rearrange the code so that the update of pcb_flags and pcb_gs/pcb_fs is non
interruptible. This fixes the problem, tested with a reproducer (which
therefore doesn't work anymore).
Likely fixes PR/53993.
To generate a diff of this commit:
cvs rdiff -u -r1.327 -r1.328 src/sys/arch/amd64/amd64/machdep.c
cvs rdiff -u -r1.56 -r1.57 src/sys/compat/linux/arch/amd64/linux_machdep.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/amd64/amd64/machdep.c
diff -u src/sys/arch/amd64/amd64/machdep.c:1.327 src/sys/arch/amd64/amd64/machdep.c:1.328
--- src/sys/arch/amd64/amd64/machdep.c:1.327 Sat Mar 9 08:42:25 2019
+++ src/sys/arch/amd64/amd64/machdep.c Sun Mar 24 13:15:42 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: machdep.c,v 1.327 2019/03/09 08:42:25 maxv Exp $ */
+/* $NetBSD: machdep.c,v 1.328 2019/03/24 13:15:42 maxv Exp $ */
/*
* Copyright (c) 1996, 1997, 1998, 2000, 2006, 2007, 2008, 2011
@@ -110,7 +110,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.327 2019/03/09 08:42:25 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.328 2019/03/24 13:15:42 maxv Exp $");
#include "opt_modular.h"
#include "opt_user_ldt.h"
@@ -1371,17 +1371,18 @@ setregs(struct lwp *l, struct exec_packa
fpu_save_area_clear(l, pack->ep_osversion >= 699002600
? __NetBSD_NPXCW__ : __NetBSD_COMPAT_NPXCW__);
- pcb->pcb_flags = 0;
x86_dbregs_clear(l);
+ kpreempt_disable();
+ pcb->pcb_flags = 0;
l->l_proc->p_flag &= ~PK_32;
-
l->l_md.md_flags = MDL_IRET;
+ cpu_segregs64_zero(l);
+ kpreempt_enable();
tf = l->l_md.md_regs;
tf->tf_ds = GSEL(GUDATA_SEL, SEL_UPL);
tf->tf_es = GSEL(GUDATA_SEL, SEL_UPL);
- cpu_segregs64_zero(l);
tf->tf_rdi = 0;
tf->tf_rsi = 0;
tf->tf_rbp = 0;
@@ -2198,12 +2199,12 @@ cpu_segregs64_zero(struct lwp *l)
struct pcb *pcb;
uint64_t zero = 0;
+ KASSERT(kpreempt_disabled());
KASSERT((l->l_proc->p_flag & PK_32) == 0);
KASSERT(l == curlwp);
pcb = lwp_getpcb(l);
- kpreempt_disable();
tf->tf_fs = 0;
tf->tf_gs = 0;
setds(GSEL(GUDATA_SEL, SEL_UPL));
@@ -2223,7 +2224,6 @@ cpu_segregs64_zero(struct lwp *l)
pcb->pcb_gs = 0;
update_descriptor(&curcpu()->ci_gdt[GUFS_SEL], &zero);
update_descriptor(&curcpu()->ci_gdt[GUGS_SEL], &zero);
- kpreempt_enable();
}
/*
Index: src/sys/compat/linux/arch/amd64/linux_machdep.c
diff -u src/sys/compat/linux/arch/amd64/linux_machdep.c:1.56 src/sys/compat/linux/arch/amd64/linux_machdep.c:1.57
--- src/sys/compat/linux/arch/amd64/linux_machdep.c:1.56 Mon Jan 1 08:03:43 2018
+++ src/sys/compat/linux/arch/amd64/linux_machdep.c Sun Mar 24 13:15:43 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: linux_machdep.c,v 1.56 2018/01/01 08:03:43 maxv Exp $ */
+/* $NetBSD: linux_machdep.c,v 1.57 2019/03/24 13:15:43 maxv Exp $ */
/*-
* Copyright (c) 2005 Emmanuel Dreyfus, all rights reserved.
@@ -33,7 +33,7 @@
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.56 2018/01/01 08:03:43 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.57 2019/03/24 13:15:43 maxv Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -91,11 +91,13 @@ linux_setregs(struct lwp *l, struct exec
#endif
fpu_save_area_clear(l, __NetBSD_NPXCW__);
- pcb->pcb_flags = 0;
+ kpreempt_disable();
+ pcb->pcb_flags = 0;
l->l_proc->p_flag &= ~PK_32;
-
l->l_md.md_flags = MDL_IRET;
+ cpu_segregs64_zero(l);
+ kpreempt_enable();
tf = l->l_md.md_regs;
tf->tf_rax = 0;
@@ -120,7 +122,6 @@ linux_setregs(struct lwp *l, struct exec
tf->tf_ss = GSEL(GUDATA_SEL, SEL_UPL);
tf->tf_ds = GSEL(GUDATA_SEL, SEL_UPL);
tf->tf_es = 0;
- cpu_segregs64_zero(l);
return;
}
