linux-kernel - Re: Sysenter crash with Nested Task Bit set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 17 Sep 2006 23:51:45 -0400
From:	Chuck Ebbert <76306.1226@...puserve.com>
To:	"In Cognito" <defend.the.world@...il.com>
Cc:	linux-kernel <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...l.org>,
	Andrew Morton <akpm@...l.org>
Subject: Re: Sysenter crash with Nested Task Bit set

In-Reply-To: <5a20704e0609171608o7ee45fdbxb94aa897c1776153@...l.gmail.com>

On Sun, 17 Sep 2006 19:08:24 -0400, "In Cognito" wrote:

> Here's a way to heat up your cpu and crash the rest of the system too:
>
> main(){
> asm("pushf\n"
>         "popl %eax\n"
> /* enable the NT bit */
>         "orl $0x4000, %eax\n"
>         "pushl %eax\n"
>         "popf\n"
>
>         "sysenter\n"
>        );
> return 0;
> }

I'll take your word that it crashes.

2.6.9 is fine.  I'd guess the iret fixups from 2.6.12 are the problem.

This doesn't crash for me, but it's probably not quite the right fix:

Signed-off-by: Chuck Ebbert <76306.1226@...puserve.com>
---
 arch/i386/kernel/traps.c |   12 +++++++++++-
 1 files changed, 11 insertions(+), 1 deletion(-)

--- 2.6.18-rc6-nb.orig/arch/i386/kernel/traps.c
+++ 2.6.18-rc6-nb/arch/i386/kernel/traps.c
@@ -516,6 +516,16 @@ fastcall void do_##name(struct pt_regs *
 	do_trap(trapnr, signr, str, 0, regs, error_code, NULL); \
 }
 
+#define DO_TSS_ERROR(trapnr, signr, str, name) \
+fastcall void do_##name(struct pt_regs * regs, long error_code) \
+{ \
+	if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr) \
+						== NOTIFY_STOP) \
+		return; \
+	regs->eflags &= ~X86_EFLAGS_NT; \
+	do_trap(trapnr, signr, str, 0, regs, error_code, NULL); \
+}
+
 #define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr) \
 fastcall void do_##name(struct pt_regs * regs, long error_code) \
 { \
@@ -561,7 +571,7 @@ DO_VM86_ERROR( 4, SIGSEGV, "overflow", o
 DO_VM86_ERROR( 5, SIGSEGV, "bounds", bounds)
 DO_ERROR_INFO( 6, SIGILL,  "invalid opcode", invalid_op, ILL_ILLOPN, regs->eip)
 DO_ERROR( 9, SIGFPE,  "coprocessor segment overrun", coprocessor_segment_overrun)
-DO_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
+DO_TSS_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
 DO_ERROR(11, SIGBUS,  "segment not present", segment_not_present)
 DO_ERROR(12, SIGBUS,  "stack segment", stack_segment)
 DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0)
-- 
Chuck
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/