[src/trunk]: src/sys/arch Mmh, allow iret to be handled when an #SS fault (T_...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/c5bfc28c3e63
branches:  trunk
changeset: 822389:c5bfc28c3e63
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sat Mar 18 13:39:23 2017 +0000

description:
Mmh, allow iret to be handled when an #SS fault (T_STKFLT) happens. Even
if the sdm is far from being clear, it appears that iret can trigger an #SS
fault if %ss points to a writable but non-present segment; in which case
the kernel would panic, thinking the fault was internal to it.

In particular, userland can create a broken segment in the ldt with
USER_LDT, update its %ss with setcontext and trigger the panic. I don't
think amd64 is affected since USER_LDT does not exist there, and the
changes on tf_ss seem correct - but I'm still adding T_STKFLT for safety.

diffstat:

 sys/arch/amd64/amd64/trap.c |  5 +++--
 sys/arch/i386/i386/trap.c   |  5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diffs (53 lines):

diff -r 374ca888dfaf -r c5bfc28c3e63 sys/arch/amd64/amd64/trap.c
--- a/sys/arch/amd64/amd64/trap.c       Sat Mar 18 13:35:57 2017 +0000
+++ b/sys/arch/amd64/amd64/trap.c       Sat Mar 18 13:39:23 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: trap.c,v 1.93 2017/03/09 00:16:07 chs Exp $    */
+/*     $NetBSD: trap.c,v 1.94 2017/03/18 13:39:23 maxv Exp $   */
 
 /*-
  * Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
@@ -68,7 +68,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.93 2017/03/09 00:16:07 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.94 2017/03/18 13:39:23 maxv Exp $");
 
 #include "opt_ddb.h"
 #include "opt_kgdb.h"
@@ -301,6 +301,7 @@
        case T_PROTFLT:
        case T_SEGNPFLT:
        case T_ALIGNFLT:
+       case T_STKFLT:
        case T_TSSFLT:
                if (p == NULL)
                        goto we_re_toast;
diff -r 374ca888dfaf -r c5bfc28c3e63 sys/arch/i386/i386/trap.c
--- a/sys/arch/i386/i386/trap.c Sat Mar 18 13:35:57 2017 +0000
+++ b/sys/arch/i386/i386/trap.c Sat Mar 18 13:39:23 2017 +0000
@@ -1,5 +1,5 @@
 
-/*     $NetBSD: trap.c,v 1.286 2017/03/14 07:02:53 ozaki-r Exp $       */
+/*     $NetBSD: trap.c,v 1.287 2017/03/18 13:39:23 maxv Exp $  */
 
 /*-
  * Copyright (c) 1998, 2000, 2005, 2006, 2007, 2008 The NetBSD Foundation, Inc.
@@ -69,7 +69,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.286 2017/03/14 07:02:53 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.287 2017/03/18 13:39:23 maxv Exp $");
 
 #include "opt_ddb.h"
 #include "opt_kgdb.h"
@@ -328,6 +328,7 @@
        case T_PROTFLT:
        case T_SEGNPFLT:
        case T_ALIGNFLT:
+       case T_STKFLT:
        case T_TSSFLT:
                if (p == NULL)
                        goto we_re_toast;