On Wed, Mar 18, 2015 at 11:20 PM, Andy Lutomirski <[email protected]> wrote: >> There is an easy way to test the theory that SYSRET is to blame. >> >> Just replace >> >> movq RCX(%rsp),%rcx >> cmpq %rcx,RIP(%rsp) /* RCX == RIP */ >> jne opportunistic_sysret_failed >> >> this "jne" with "jmp", and try to reproduce. >> > > This is a classic root exploit, and it's why we check for > non-canonical RIP. In theory, that's the only way this can happen. > Intel screwed up -- AMD never fails SYSRET.
I'm not saying the code needs to be changed. I'm saying that *people who see the crash* can make this change, run the modified kernel, and if crash disappears - then it is caused by "opportunistic SYSRET". -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
