[src/trunk]: src/sys Fix a tiny race in setregs and linux_setregs. Between th...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/340a9e4dbb78
branches:  trunk
changeset: 449800:340a9e4dbb78
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sun Mar 24 13:15:42 2019 +0000

description:
Fix a tiny race in setregs and linux_setregs. Between the moment we set
pcb_flags to zero, and the moment cpu_segregs64_zero resets pcb_gs, we may
be preempted.

If this happens, and if the calling LWP was a 32bit thread, when switching
back to that LWP, the context switcher sees that PCB_COMPAT32 is not set in
pcb_flags and tries to perform a 64bit context switch; but pcb_gs contains
a 32bit GDT descriptor, and not a 64bit GS.base value. The wrmsr therefore
faults because the value is non-canonical, and this fault is fatal.

Rearrange the code so that the update of pcb_flags and pcb_gs/pcb_fs is non
interruptible. This fixes the problem, tested with a reproducer (which
therefore doesn't work anymore).

Likely fixes PR/53993.

diffstat:

 sys/arch/amd64/amd64/machdep.c              |  14 +++++++-------
 sys/compat/linux/arch/amd64/linux_machdep.c |  11 ++++++-----
 2 files changed, 13 insertions(+), 12 deletions(-)

diffs (104 lines):

diff -r 6ba3c0eb6c46 -r 340a9e4dbb78 sys/arch/amd64/amd64/machdep.c
--- a/sys/arch/amd64/amd64/machdep.c    Sun Mar 24 11:22:06 2019 +0000
+++ b/sys/arch/amd64/amd64/machdep.c    Sun Mar 24 13:15:42 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: machdep.c,v 1.327 2019/03/09 08:42:25 maxv Exp $       */
+/*     $NetBSD: machdep.c,v 1.328 2019/03/24 13:15:42 maxv Exp $       */
 
 /*
  * Copyright (c) 1996, 1997, 1998, 2000, 2006, 2007, 2008, 2011
@@ -110,7 +110,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.327 2019/03/09 08:42:25 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: machdep.c,v 1.328 2019/03/24 13:15:42 maxv Exp $");
 
 #include "opt_modular.h"
 #include "opt_user_ldt.h"
@@ -1371,17 +1371,18 @@
 
        fpu_save_area_clear(l, pack->ep_osversion >= 699002600
            ? __NetBSD_NPXCW__ : __NetBSD_COMPAT_NPXCW__);
-       pcb->pcb_flags = 0;
        x86_dbregs_clear(l);
 
+       kpreempt_disable();
+       pcb->pcb_flags = 0;
        l->l_proc->p_flag &= ~PK_32;
-
        l->l_md.md_flags = MDL_IRET;
+       cpu_segregs64_zero(l);
+       kpreempt_enable();
 
        tf = l->l_md.md_regs;
        tf->tf_ds = GSEL(GUDATA_SEL, SEL_UPL);
        tf->tf_es = GSEL(GUDATA_SEL, SEL_UPL);
-       cpu_segregs64_zero(l);
        tf->tf_rdi = 0;
        tf->tf_rsi = 0;
        tf->tf_rbp = 0;
@@ -2198,12 +2199,12 @@
        struct pcb *pcb;
        uint64_t zero = 0;
 
+       KASSERT(kpreempt_disabled());
        KASSERT((l->l_proc->p_flag & PK_32) == 0);
        KASSERT(l == curlwp);
 
        pcb = lwp_getpcb(l);
 
-       kpreempt_disable();
        tf->tf_fs = 0;
        tf->tf_gs = 0;
        setds(GSEL(GUDATA_SEL, SEL_UPL));
@@ -2223,7 +2224,6 @@
        pcb->pcb_gs = 0;
        update_descriptor(&curcpu()->ci_gdt[GUFS_SEL], &zero);
        update_descriptor(&curcpu()->ci_gdt[GUGS_SEL], &zero);
-       kpreempt_enable();
 }
 
 /*
diff -r 6ba3c0eb6c46 -r 340a9e4dbb78 sys/compat/linux/arch/amd64/linux_machdep.c
--- a/sys/compat/linux/arch/amd64/linux_machdep.c       Sun Mar 24 11:22:06 2019 +0000
+++ b/sys/compat/linux/arch/amd64/linux_machdep.c       Sun Mar 24 13:15:42 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: linux_machdep.c,v 1.56 2018/01/01 08:03:43 maxv Exp $ */
+/*     $NetBSD: linux_machdep.c,v 1.57 2019/03/24 13:15:43 maxv Exp $ */
 
 /*-
  * Copyright (c) 2005 Emmanuel Dreyfus, all rights reserved.
@@ -33,7 +33,7 @@
 
 #include <sys/cdefs.h>
 
-__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.56 2018/01/01 08:03:43 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: linux_machdep.c,v 1.57 2019/03/24 13:15:43 maxv Exp $");
 
 #include <sys/param.h>
 #include <sys/types.h>
@@ -91,11 +91,13 @@
 #endif
 
        fpu_save_area_clear(l, __NetBSD_NPXCW__);
+
+       kpreempt_disable();
        pcb->pcb_flags = 0;
-
        l->l_proc->p_flag &= ~PK_32;
-
        l->l_md.md_flags = MDL_IRET;
+       cpu_segregs64_zero(l);
+       kpreempt_enable();
 
        tf = l->l_md.md_regs;
        tf->tf_rax = 0;
@@ -120,7 +122,6 @@
        tf->tf_ss = GSEL(GUDATA_SEL, SEL_UPL);
        tf->tf_ds = GSEL(GUDATA_SEL, SEL_UPL);
        tf->tf_es = 0;
-       cpu_segregs64_zero(l);
 
        return;
 }