Module Name: src
Committed By: maxv
Date: Wed Jan 10 20:51:11 UTC 2018
Modified Files:
src/sys/arch/amd64/amd64: trap.c
Log Message:
Restrict the check: SMAP faults are always protection violations, as the
SDM points out, so make sure we have PGEX_P. This way NULL dereferences -
which are caused by an unmapped VA, and therefore are not protection
violations - don't take this branch, and don't display a misleading
"SMAP" in ddb.
Adding a PGEX_P check, or not, does not essentially change anything from
a security point of view, it's just a matter of what gets displayed when
a fatal fault comes in.
I didn't put PGEX_P until now, because initially when I wrote the SMAP
implementation Qemu did not always receive the fault if the PGEX_P check
was there, while a native i5 would. I'm unable to reproduce this issue
with a recent Qemu, so I assume I did something wrong when testing in the
first place.
To generate a diff of this commit:
cvs rdiff -u -r1.109 -r1.110 src/sys/arch/amd64/amd64/trap.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/amd64/amd64/trap.c
diff -u src/sys/arch/amd64/amd64/trap.c:1.109 src/sys/arch/amd64/amd64/trap.c:1.110
--- src/sys/arch/amd64/amd64/trap.c:1.109 Sat Dec 9 00:52:41 2017
+++ src/sys/arch/amd64/amd64/trap.c Wed Jan 10 20:51:11 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: trap.c,v 1.109 2017/12/09 00:52:41 christos Exp $ */
+/* $NetBSD: trap.c,v 1.110 2018/01/10 20:51:11 maxv Exp $ */
/*
* Copyright (c) 1998, 2000, 2017 The NetBSD Foundation, Inc.
@@ -64,7 +64,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.109 2017/12/09 00:52:41 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.110 2018/01/10 20:51:11 maxv Exp $");
#include "opt_ddb.h"
#include "opt_kgdb.h"
@@ -562,13 +562,11 @@ trap(struct trapframe *frame)
}
}
- if (cr2 < VM_MAXUSER_ADDRESS) {
+ if ((frame->tf_err & PGEX_P) &&
+ cr2 < VM_MAXUSER_ADDRESS) {
/* SMAP might have brought us here */
if (onfault_handler(pcb, frame) == NULL) {
- panic("prevented %s %p (SMAP)",
- (cr2 < PAGE_SIZE
- ? "null pointer dereference at"
- : "access to"),
+ panic("prevented access to %p (SMAP)",
(void *)cr2);
}
}
