linux-kernel - Re: git commit 9fd67b4ed0714ab718f1f9bd14c344af336a6df7 (x86-64: Give vvars their own page) breaks Xen PV guests (64-bit).

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Jul 2011 08:18:27 +0100
From:	"Jan Beulich" <JBeulich@...ell.com>
To:	"Andrew Lutomirski" <luto@....edu>
Cc:	<jj@...osbits.net>, <mingo@...e.hu>,
	"Ian Campbell" <Ian.Campbell@...citrix.com>,
	"Stefano Stabellini" <stefano.stabellini@...citrix.com>,
	<andi@...stfloor.org>, <pageexec@...email.hu>, <brgerst@...il.com>,
	<richard.weinberger@...il.com>,
	"Jeremy Fitzhardinge" <jeremy@...p.org>, <arjan@...radead.org>,
	<mikpe@...uu.se>, <Louis.Rilling@...labs.com>,
	<xen-devel@...ts.xensource.com>,
	"Konrad Rzeszutek Wilk" <konrad.wilk@...cle.com>,
	<linux-kernel@...r.kernel.org>, <Valdis.Kletnieks@...edu>
Subject: Re: git commit 9fd67b4ed0714ab718f1f9bd14c344af336a6df7
	 (x86-64: Give vvars their own page) breaks Xen PV guests
	 (64-bit).

>>> On 25.07.11 at 20:10, Andrew Lutomirski <luto@....edu> wrote:
> On Mon, Jul 25, 2011 at 12:10 PM, Konrad Rzeszutek Wilk <konrad.wilk@...cle.com> wrote:
>> However, this is what I get later on, any ideas?
> 
>> [    0.585880] init[1] illegal int 0xcc from 32-bit mode ip:ffffffffff600400 
> cs:e033 sp:7fff230ca088 ax:ffffffffff600400 si:7faee3e822bf di:7fff230ca158
> 
> That will, indeed, crash your system.
> 
> 0xe033 is FLAT_RING3_CS64
> 
> Jeremy / other Xen people:  I'm trying to implement a lightweight
> check to distinguish a trap from a sane (i.e. allowable for syscalls)
> 64-bit user context from anything else.  There seems to be precedent
> for using ->cs == __USER_CS to detect 64-bitness; for example, step.c
> contains:
> 
> #ifdef CONFIG_X86_64
>                 case 0x40 ... 0x4f:
>                         if (regs->cs != __USER_CS)
>                                 /* 32-bit mode: register increment */
>                                 return 0;
>                         /* 64-bit mode: REX prefix */
>                         continue;
> #endif
> 
> The prefetch opcode checker in mm/fault.c does something similar.

That (namely the latter) has been in place basically forever (also in
the original http://xenbits.xen.org/hg/linux-2.6.18-xen.hg/ tree),
but indeed would seem to need addition of a check against Xen's
ring-3 64-bit CS. It's just that in the pre-existing cases the
consequences are at worst moderate...

Jan

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/