linux-kernel - [PATCH] x86, vm86: fix preemption bug for int3 breakpoint handlers.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 24 May 2009 18:35:57 -0400 (EDT)
From:	Bart Oldeman <bartoldeman@...rs.sourceforge.net>
To:	linux-kernel@...r.kernel.org
cc:	tglx@...utronix.de, mingo@...e.hu, stable@...nel.org
Subject: [PATCH] x86, vm86: fix preemption bug for int3 breakpoint
 handlers.

Impact: fix kernel bug such as:
May 22 16:47:47 localhost kernel: note: dosemu.bin[5281] exited with preempt_count 1

Commit be716615fe596ee117292dc615e95f707fb67fd1 ("x86, vm86:
fix preemption bug") fixes the problem for debug exceptions but not
for breakpoints. This change also fixes breakpoints. As the offending
codepath is jumping directly back to entry.S, move the logic to
vm86_32.c, and re-enable preemption in vm86_handle_trap() before
calling return_to_32bit().

Cc: stable@...nel.org
Signed-off-by: Bart Oldeman <bartoldeman@...rs.sourceforge.net>
---
  arch/x86/kernel/traps.c   |    4 +---
  arch/x86/kernel/vm86_32.c |    6 +++++-
  2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index f07ada4..98ebe1c 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -590,10 +590,8 @@ clear_dr7:

  #ifdef CONFIG_X86_32
  debug_vm86:
-	/* reenable preemption: handle_vm86_trap() might sleep */
-	dec_preempt_count();
  	handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code, 1);
-	conditional_cli(regs);
+	preempt_conditional_cli(regs);
  	return;
  #endif

diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index b8035a0..17c7734 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -551,8 +551,12 @@ cannot_handle:
  int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
  {
  	if (VMPI.is_vm86pus) {
-		if ((trapno == 3) || (trapno == 1))
+		if ((trapno == 3) || (trapno == 1)) {
+			/* re-enable preemption: return_to_32bit()
+			   jumps straight to entry_32.S */
+			dec_preempt_count();
  			return_to_32bit(regs, VM86_TRAP + (trapno << 8));
+		}
  		do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
  		return 0;
  	}
-- 
1.6.2.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/