On 07/10/13 10:48, Frediano Ziglio wrote: > Due to the way kernel is initialized under Xen is possible that the > ring1 selector used by the kernel for the boot cpu end up to be copied > to userspace leading to segmentation fault in the userspace. > > Xen code in the kernel initialize no-boot cpus with correct selectors (ds > and es set to __USER_DS) but the boot one keep the ring1 (passed by Xen). > On task context switch (switch_to) we assume that ds, es and cs already > point to __USER_DS and __KERNEL_CSso these selector are not changed. > > If processor is an Intel that support sysenter instruction sysenter/sysexit > is used so ds and es are not restored switching back from kernel to > userspace. In the case the selectors point to a ring1 instead of __USER_DS > the userspace code will crash on first memory access attempt (to be > precise Xen on the emulated iret used to do sysexit will detect and set ds > and es to zero which lead to GPF anyway). > > Now if an userspace process call kernel using sysenter and get rescheduled > (for me it happen on a specific init calling wait4) could happen that the > ring1 selector is set to ds and es. > > This is quite hard to detect cause after a while these selectors are fixed > (__USER_DS seems sticky). > > Bisecting the code commit 7076aada1040de4ed79a5977dbabdb5e5ea5e249 appears > to be the first one that have this issue. > > Signed-off-by: Frediano Ziglio <[email protected]>
Reviewed-by: Andrew Cooper <[email protected]> > --- > arch/x86/xen/smp.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > > Just changed comment on source code as suggested by Andrew Cooper. > > > diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c > index d99cae8..6d89fcc 100644 > --- a/arch/x86/xen/smp.c > +++ b/arch/x86/xen/smp.c > @@ -245,6 +245,15 @@ static void __init xen_smp_prepare_boot_cpu(void) > old memory can be recycled */ > make_lowmem_page_readwrite(xen_initial_gdt); > > +#ifdef CONFIG_X86_32 > + /* > + * Xen starts us with XEN_FLAT_RING1_DS, but linux code > + * expects __USER_DS > + */ > + loadsegment(ds, __USER_DS); > + loadsegment(es, __USER_DS); > +#endif > + > xen_filter_cpu_maps(); > xen_setup_vcpu_info_placement(); > } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
