lkml.org 
[lkml]   [2014]   [Feb]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: perf_fuzzer compiled for x32 causes reboot
On Mon, 24 Feb 2014 10:34:13 -0800
"H. Peter Anvin" <hpa@zytor.com> wrote:

> On 02/24/2014 10:07 AM, Vince Weaver wrote:
> >>
> >> Anyway I've attached the full tail end of the trace if you want to see
> >> everything that happens.
> >
> > and then I note there are *two* kernel page faults.
> >
> > perf_fuzzer-2979 [000] 161.475924: page_fault_kernel: address=irq_stack_union ip=copy_user_generic_string error_code=0x0
> > address=0x1 ip=0xffffffff812a7d9c error_code=0x0
> > perf_fuzzer-2979 [000] 161.475924: function: __do_page_fault
> > perf_fuzzer-2979 [000] 161.475924: function: bad_area_nosemaphore
> > perf_fuzzer-2979 [000] 161.475925: function: __bad_area_nosemaphore
> > perf_fuzzer-2979 [000] 161.475925: function: no_context
> > perf_fuzzer-2979 [000] 161.475925: function: fixup_exception
> > perf_fuzzer-2979 [000] 161.475926: function: search_exception_tables
> > perf_fuzzer-2979 [000] 161.475926: function: search_extable
> > perf_fuzzer-2979 [000] 161.475927: function: copy_user_handle_tail
> > perf_fuzzer-2979 [000] 161.475927: function: trace_do_page_fault
> > perf_fuzzer-2979 [000] 161.475928: page_fault_kernel: address=irq_stack_union ip=copy_user_handle_tail error_code=0x0
> > address=0x1 ip=0xffffffff812a92bb error_code=0x0
> > perf_fuzzer-2979 [000] 161.475928: function: __do_page_fault
> > perf_fuzzer-2979 [000] 161.475928: function: bad_area_nosemaphore
> > perf_fuzzer-2979 [000] 161.475929: function: __bad_area_nosemaphore
> > perf_fuzzer-2979 [000] 161.475929: function: no_context
> > perf_fuzzer-2979 [000] 161.475929: function: fixup_exception
> > perf_fuzzer-2979 [000] 161.475929: function: search_exception_tables
> > perf_fuzzer-2979 [000] 161.475930: function: search_extable
> > perf_fuzzer-2979 [000] 161.475931: function: perf_output_begin
> > perf_fuzzer-2979 [000] 161.475931: function: perf_output_copy
> >
> > That second one is in copy_user_handle_tail()
> >
>
> Either way, it really seems like we have a case of CR2 leakage out of
> the NMI context.

Ah, and x86_64 saves off the cr2 register when entering NMI and restores
it before returning. But it seems to be missing from the i386 code.

-- Steve


\
 
 \ /
  Last update: 2014-02-24 21:01    [W:0.462 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site