linux-kernel - Re: [x86/asm/entry] BUG: unable to handle kernel paging request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 8 Mar 2015 20:59:21 +0100
From:	Denys Vlasenko <vda.linux@...glemail.com>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	Fengguang Wu <fengguang.wu@...el.com>, X86 ML <x86@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Ingo Molnar <mingo@...nel.org>, LKP <lkp@...org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [x86/asm/entry] BUG: unable to handle kernel paging request

On Sun, Mar 8, 2015 at 8:41 PM, Andy Lutomirski <luto@...capital.net> wrote:
>>> 4. Not directly related, but the 32-bit tss_struct contains this gem:
>>>
>>>     /*
>>>      * .. and then another 0x100 bytes for the emergency kernel stack:
>>>      */
>>>     unsigned long        stack[64];
>>>
>>> Last I checked, 0x100 != 64.  Also, wow, this is kind of disgusting. :)
>>
>>
>> Seems to be unused: I commented it out on "defconfig" build
>> and got no build errors.
>
> It's used.  On 32-bit, NMIs don't use task gates (I don't know why),
> so sysenter is set up to set rsp to point to that "stack".

Where is it set up that way? Aha. Here?

void enable_sep_cpu(void)
{
        int cpu = get_cpu();
        struct tss_struct *tss = &per_cpu(cpu_tss, cpu);
...
        tss->x86_tss.ss1 = __KERNEL_CS;
        tss->x86_tss.sp1 = sizeof(struct tss_struct) + (unsigned long) tss;
        wrmsr(MSR_IA32_SYSENTER_CS, __KERNEL_CS, 0);
        wrmsr(MSR_IA32_SYSENTER_ESP, tss->x86_tss.sp1, 0);


Can this be written in a way so that the field we use here
in fact gets referenced? I propose this:

        tss->x86_tss.sp1 = (unsinged long) &tss->stack + sizeof(tss->stack);

(And I would rename it "emergency_stack" or something).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/