From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: [PATCH v2] xen: Fix possible user space selector corruption Date: Mon, 7 Oct 2013 10:49:25 +0100 Message-ID: <525283A5.4020904__48039.1850964681$1381139469$gmane$org@citrix.com> References: <1380788677.30462.1.camel@hamster.uk.xensource.com> <524D4132.3000809@citrix.com> <1380804692.30462.3.camel@hamster.uk.xensource.com> <20131004132033.GA26673@phenom.dumpdata.com> <524EC3C1.4010304@citrix.com> <5252815E.70504@citrix.com> <1381139286.31436.2.camel@hamster.uk.xensource.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1VT7RR-00061E-Mo for xen-devel@lists.xenproject.org; Mon, 07 Oct 2013 09:49:29 +0000 In-Reply-To: <1381139286.31436.2.camel@hamster.uk.xensource.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Frediano Ziglio Cc: xen-devel@lists.xenproject.org, Boris Ostrovsky , David Vrabel , linux-kernel@vger.kernel.org List-Id: xen-devel@lists.xenproject.org On 07/10/13 10:48, Frediano Ziglio wrote: > Due to the way kernel is initialized under Xen is possible that the > ring1 selector used by the kernel for the boot cpu end up to be copied > to userspace leading to segmentation fault in the userspace. > > Xen code in the kernel initialize no-boot cpus with correct selectors (ds > and es set to __USER_DS) but the boot one keep the ring1 (passed by Xen). > On task context switch (switch_to) we assume that ds, es and cs already > point to __USER_DS and __KERNEL_CSso these selector are not changed. > > If processor is an Intel that support sysenter instruction sysenter/sysexit > is used so ds and es are not restored switching back from kernel to > userspace. In the case the selectors point to a ring1 instead of __USER_DS > the userspace code will crash on first memory access attempt (to be > precise Xen on the emulated iret used to do sysexit will detect and set ds > and es to zero which lead to GPF anyway). > > Now if an userspace process call kernel using sysenter and get rescheduled > (for me it happen on a specific init calling wait4) could happen that the > ring1 selector is set to ds and es. > > This is quite hard to detect cause after a while these selectors are fixed > (__USER_DS seems sticky). > > Bisecting the code commit 7076aada1040de4ed79a5977dbabdb5e5ea5e249 appears > to be the first one that have this issue. > > Signed-off-by: Frediano Ziglio Reviewed-by: Andrew Cooper > --- > arch/x86/xen/smp.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > > Just changed comment on source code as suggested by Andrew Cooper. > > > diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c > index d99cae8..6d89fcc 100644 > --- a/arch/x86/xen/smp.c > +++ b/arch/x86/xen/smp.c > @@ -245,6 +245,15 @@ static void __init xen_smp_prepare_boot_cpu(void) > old memory can be recycled */ > make_lowmem_page_readwrite(xen_initial_gdt); > > +#ifdef CONFIG_X86_32 > + /* > + * Xen starts us with XEN_FLAT_RING1_DS, but linux code > + * expects __USER_DS > + */ > + loadsegment(ds, __USER_DS); > + loadsegment(es, __USER_DS); > +#endif > + > xen_filter_cpu_maps(); > xen_setup_vcpu_info_placement(); > }