linux-kernel - Re: Sysenter crash with Nested Task Bit set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1158569067.6376.8.camel@Homer.simpson.net>
Date:	Mon, 18 Sep 2006 08:44:27 +0000
From:	Mike Galbraith <efault@....de>
To:	Andrew Morton <akpm@...l.org>
Cc:	Chuck Ebbert <76306.1226@...puserve.com>,
	In Cognito <defend.the.world@...il.com>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...l.org>
Subject: Re: Sysenter crash with Nested Task Bit set

On Sun, 2006-09-17 at 22:25 -0700, Andrew Morton wrote:
> On Sun, 17 Sep 2006 23:51:45 -0400
> Chuck Ebbert <76306.1226@...puserve.com> wrote:
> 
> > In-Reply-To: <5a20704e0609171608o7ee45fdbxb94aa897c1776153@...l.gmail.com>
> > 
> > On Sun, 17 Sep 2006 19:08:24 -0400, "In Cognito" wrote:
> > 
> > > Here's a way to heat up your cpu and crash the rest of the system too:
> > >
> > > main(){
> > > asm("pushf\n"
> > >         "popl %eax\n"
> > > /* enable the NT bit */
> > >         "orl $0x4000, %eax\n"
> > >         "pushl %eax\n"
> > >         "popf\n"
> > >
> > >         "sysenter\n"
> > >        );
> > > return 0;
> > > }
> > 
> > I'll take your word that it crashes.
> 
> It doesn't for me - I get a segfault.
> 
> That's on a PIII.  Are recenter CPUs different in this regard?

I guess so.  That proglet does very bad things to my P4/HT.  I too get a
segfault, but then init goes insane and may reap the proglet's parent
shell, but then again, it may decide to reap the shell next door.
Thereafter, init is running/gaga.  (18-rc7)

Chuck's patch did indeed make it stop doing that.

> > 2.6.9 is fine.  I'd guess the iret fixups from 2.6.12 are the problem.
> > 
> > This doesn't crash for me, but it's probably not quite the right fix:
> > 
> > Signed-off-by: Chuck Ebbert <76306.1226@...puserve.com>
> > ---
> >  arch/i386/kernel/traps.c |   12 +++++++++++-
> >  1 files changed, 11 insertions(+), 1 deletion(-)
> > 
> > --- 2.6.18-rc6-nb.orig/arch/i386/kernel/traps.c
> > +++ 2.6.18-rc6-nb/arch/i386/kernel/traps.c
> > @@ -516,6 +516,16 @@ fastcall void do_##name(struct pt_regs *
> >  	do_trap(trapnr, signr, str, 0, regs, error_code, NULL); \
> >  }
> >  
> > +#define DO_TSS_ERROR(trapnr, signr, str, name) \
> > +fastcall void do_##name(struct pt_regs * regs, long error_code) \
> > +{ \
> > +	if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr) \
> > +						== NOTIFY_STOP) \
> > +		return; \
> > +	regs->eflags &= ~X86_EFLAGS_NT; \
> > +	do_trap(trapnr, signr, str, 0, regs, error_code, NULL); \
> > +}
> > +
> >  #define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr) \
> >  fastcall void do_##name(struct pt_regs * regs, long error_code) \
> >  { \
> > @@ -561,7 +571,7 @@ DO_VM86_ERROR( 4, SIGSEGV, "overflow", o
> >  DO_VM86_ERROR( 5, SIGSEGV, "bounds", bounds)
> >  DO_ERROR_INFO( 6, SIGILL,  "invalid opcode", invalid_op, ILL_ILLOPN, regs->eip)
> >  DO_ERROR( 9, SIGFPE,  "coprocessor segment overrun", coprocessor_segment_overrun)
> > -DO_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
> > +DO_TSS_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
> >  DO_ERROR(11, SIGBUS,  "segment not present", segment_not_present)
> >  DO_ERROR(12, SIGBUS,  "stack segment", stack_segment)
> >  DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0)
> > -- 
> > Chuck
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/