From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751242AbdCQSJW (ORCPT ); Fri, 17 Mar 2017 14:09:22 -0400 Received: from mail-it0-f66.google.com ([209.85.214.66]:35257 "EHLO mail-it0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751122AbdCQSJT (ORCPT ); Fri, 17 Mar 2017 14:09:19 -0400 MIME-Version: 1.0 In-Reply-To: References: <20170317115924.GA82960@inn.lkp.intel.com> From: Linus Torvalds Date: Fri, 17 Mar 2017 11:07:48 -0700 X-Google-Sender-Auth: BYTS6L8tafLVAuIHOwg6syoZkJ8 Message-ID: Subject: Re: [x86] 45fc8757d1: BUG:unable_to_handle_kernel To: kernel test robot Cc: Thomas Garnier , Ingo Molnar , Alexander Potapenko , Andrew Morton , Andrey Ryabinin , Andy Lutomirski , Ard Biesheuvel , Boris Ostrovsky , Borislav Petkov , Chris Wilson , Christian Borntraeger , Dmitry Vyukov , Frederic Weisbecker , Jiri Kosina , Joerg Roedel , Jonathan Corbet , Josh Poimboeuf , Juergen Gross , Kees Cook , Len Brown , Lorenzo Stoakes , "Luis R . Rodriguez" , Matt Fleming , Michal Hocko , Paolo Bonzini , Paul Gortmaker , Pavel Machek , Peter Zijlstra , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , "Rafael J . Wysocki" , Rusty Russell , Stanislaw Gruszka , Thomas Gleixner , Tim Chen , Vitaly Kuznetsov , zijun_hu , LKML , "H. Peter Anvin" , tipbuild@zytor.com, LKP Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Mar 17, 2017 at 11:00 AM, Linus Torvalds wrote: > On Fri, Mar 17, 2017 at 10:49 AM, Linus Torvalds > wrote: >> >> The linear address can be used to look up which entry it is. I assume >> the GDT starts at ffffffffff577000, and that this is at offset 0x60 >> from that. Whatever descriptor that would be.. > > Hmm. That should be gdt index 12, aka GDT_ENTRY_TLS_MIN. > > I guess user space can set almost anything there. Including setting a > segment type that isn't accessed, and that the CPU will change on the > first actual access. > > We do have code to verify the limits and types etc iirc, I guess we > can make sure to set the accessed bit too. Hmm. "fill_ldt()" does this: desc->type = (info->read_exec_only ^ 1) << 1; desc->type |= info->contents << 2; which always leaves bit #0 of ->type clear. That's the A bit. Does the problem go away if we just add a desc->type |= 1; to the end there? But it is entirely possible that I'm missing something here. It's been _years_ since I looked at descriptor table entries. Linus From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============2454845648291563087==" MIME-Version: 1.0 From: Linus Torvalds To: lkp@lists.01.org Subject: Re: [x86] 45fc8757d1: BUG:unable_to_handle_kernel Date: Fri, 17 Mar 2017 11:07:48 -0700 Message-ID: In-Reply-To: List-Id: --===============2454845648291563087== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Fri, Mar 17, 2017 at 11:00 AM, Linus Torvalds wrote: > On Fri, Mar 17, 2017 at 10:49 AM, Linus Torvalds > wrote: >> >> The linear address can be used to look up which entry it is. I assume >> the GDT starts at ffffffffff577000, and that this is at offset 0x60 >> from that. Whatever descriptor that would be.. > > Hmm. That should be gdt index 12, aka GDT_ENTRY_TLS_MIN. > > I guess user space can set almost anything there. Including setting a > segment type that isn't accessed, and that the CPU will change on the > first actual access. > > We do have code to verify the limits and types etc iirc, I guess we > can make sure to set the accessed bit too. Hmm. "fill_ldt()" does this: desc->type =3D (info->read_exec_only ^ 1) << 1; desc->type |=3D info->contents << 2; which always leaves bit #0 of ->type clear. That's the A bit. Does the problem go away if we just add a desc->type |=3D 1; to the end there? But it is entirely possible that I'm missing something here. It's been _years_ since I looked at descriptor table entries. Linus --===============2454845648291563087==--