From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Vrabel Subject: Re: [PATCH] xen: Fix possible user space selector corruption Date: Thu, 3 Oct 2013 10:47:44 +0100 Message-ID: <524D3D40.4040907__5944.17379838905$1380793792$gmane$org@citrix.com> References: <1380788677.30462.1.camel@hamster.uk.xensource.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta4.messagelabs.com ([85.158.143.247]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1VRfVd-0006hd-6s for xen-devel@lists.xenproject.org; Thu, 03 Oct 2013 09:47:49 +0000 In-Reply-To: <1380788677.30462.1.camel@hamster.uk.xensource.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Frediano Ziglio Cc: xen-devel@lists.xenproject.org, Boris Ostrovsky , David Vrabel , linux-kernel@vger.kernel.org List-Id: xen-devel@lists.xenproject.org On 03/10/13 09:24, Frediano Ziglio wrote: > Due to the way kernel is initialized under Xen is possible that the ring1 > selector used by the kernel for the boot cpu end up to be copied to > userspace leading to segmentation fault in the userspace. > > > Xen code in the kernel initialize no-boot cpus with correct selectors (ds > and es set to __USER_DS) but the boot one keep the ring1 (passed by Xen). > On task context switch (switch_to) we assume that ds, es and cs already > point to __USER_DS and __KERNEL_CSso these selector are not changed. > > If processor is an Intel that support sysenter instruction sysenter/sysexit > is used so ds and es are not restored switching back from kernel to > userspace. In the case the selectors point to a ring1 instead of __USER_DS > the userspace code will crash on first memory access attempt (to be > precise Xen on the emulated iret used to do sysexit will detect and set ds > and es to zero which lead to GPF anyway). > > Now if an userspace process call kernel using sysenter and get rescheduled > (for me it happen on a specific init calling wait4) could happen that the > ring1 selector is set to ds and es. > > This is quite hard to detect cause after a while these selectors are fixed > (__USER_DS seems sticky). > > Bisecting the code commit 7076aada1040de4ed79a5977dbabdb5e5ea5e249 appears > to be the first one that have this issue. > > Signed-off-by: Frediano Ziglio Looks okay to me but I don't really understand it... David