From mboxrd@z Thu Jan  1 00:00:00 1970
From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Subject: Re: [PATCH v4 0/3] x86: modify_ldt improvement, test,
 and config option
Date: Mon, 27 Jul 2015 12:18:52 -0400
Message-ID: <55B659EC.5030009__35341.4901219823$1438014116$gmane$org@oracle.com>
References: <cover.1437802102.git.luto@kernel.org> <55B64FEA.70204@oracle.com>
	<CALCETrUEYTCwYzA0bvG=EJOi+pdXX=FZXoaQc4tYGkJATM7x3g@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <CALCETrUEYTCwYzA0bvG=EJOi+pdXX=FZXoaQc4tYGkJATM7x3g@mail.gmail.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Andy Lutomirski <luto@amacapital.net>
Cc: "security@kernel.org" <security@kernel.org>, Jan Beulich <jbeulich@suse.com>, Peter Zijlstra <peterz@infradead.org>, Andrew Cooper <andrew.cooper3@citrix.com>, X86 ML <x86@kernel.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Steven Rostedt <rostedt@goodmis.org>, xen-devel <xen-devel@lists.xen.org>, Borislav Petkov <bp@alien8.de>, Andy Lutomirski <luto@kernel.org>, Sasha Levin <sasha.levin@oracle.com>
List-Id: xen-devel@lists.xenproject.org

On 07/27/2015 11:53 AM, Andy Lutomirski wrote:
> On Mon, Jul 27, 2015 at 8:36 AM, Boris Ostrovsky
> <boris.ostrovsky@oracle.com> wrote:
>> On 07/25/2015 01:36 AM, Andy Lutomirski wrote:
>>> Here's v3.  It fixes the "dazed and confused" issue, I hope.  It's also
>>> probably a good general attack surface reduction, and it replaces some
>>> scary code with IMO less scary code.
>>>
>>> Also, servers and embedded systems should probably turn off modify_ldt.
>>> This makes that possible.
>>>
>>> Xen people, can you take a look at this?
>>>
>>> Willy and Kees: I left the config option alone.  The -tiny people will
>>> like it, and we can always add a sysctl of some sort later.
>>>
>>> Changes from v3:
>>>    - Hopefully fixed Xen.
>>
>> 32b-on-32b fails in the same manner. (but non-zero LDT is taken care of)
>>
>>>    - Fixed 32-bit test case on 32-bit native kernel.
>>
>> I am not sure I see what changed.
> I misplaced the fix in the wrong git commit, so I failed to sent it.  Oops.
>
> I just sent v4.1 of patch 3.  Can you try that?


I am hitting BUG() in Xen code (returning from a hypercall) when freeing 
LDT in destroy_context(). Interestingly though when I run the test in 
the debugger I get SIGILL (just like before) but no BUG().

Let me get back to you on that later today.


-boris