linux-kernel - Re: [Xen-devel][PATCH v3] xen/pv: Fix a boot up hang revealed by int3 self test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 Jul 2019 06:46:14 +0200
From:   Juergen Gross <jgross@...e.com>
To:     Zhenzhong Duan <zhenzhong.duan@...cle.com>,
        linux-kernel@...r.kernel.org
Cc:     bp@...en8.de, Andrew Cooper <andrew.cooper3@...rix.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Andy Lutomirski <luto@...nel.org>, sstabellini@...nel.org,
        x86@...nel.org, tglx@...utronix.de, xen-devel@...ts.xenproject.org,
        boris.ostrovsky@...cle.com, mingo@...hat.com
Subject: Re: [Xen-devel][PATCH v3] xen/pv: Fix a boot up hang revealed by int3
 self test

On 14.07.19 11:15, Zhenzhong Duan wrote:
> Commit 7457c0da024b ("x86/alternatives: Add int3_emulate_call()
> selftest") is used to ensure there is a gap setup in int3 exception stack
> which could be used for inserting call return address.
> 
> This gap is missed in XEN PV int3 exception entry path, then below panic
> triggered:
> 
> [    0.772876] general protection fault: 0000 [#1] SMP NOPTI
> [    0.772886] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.2.0+ #11
> [    0.772893] RIP: e030:int3_magic+0x0/0x7
> [    0.772905] RSP: 3507:ffffffff82203e98 EFLAGS: 00000246
> [    0.773334] Call Trace:
> [    0.773334]  alternative_instructions+0x3d/0x12e
> [    0.773334]  check_bugs+0x7c9/0x887
> [    0.773334]  ? __get_locked_pte+0x178/0x1f0
> [    0.773334]  start_kernel+0x4ff/0x535
> [    0.773334]  ? set_init_arg+0x55/0x55
> [    0.773334]  xen_start_kernel+0x571/0x57a
> 
> For 64bit PV guests, Xen's ABI enters the kernel with using SYSRET, with
> %rcx/%r11 on the stack. To convert back to "normal" looking exceptions,
> the xen thunks do 'xen_*: pop %rcx; pop %r11; jmp *'.
> 
> E.g. Extracting 'xen_pv_trap xenint3' we have:
> xen_xenint3:
>   pop %rcx;
>   pop %r11;
>   jmp xenint3
> 
> As xenint3 and int3 entry code are same except xenint3 doesn't generate
> a gap, we can fix it by using int3 and drop useless xenint3.
> 
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@...cle.com>

Reviewed-by: Juergen Gross <jgross@...e.com>


Juergen