Messages in this thread | | | From | Denys Vlasenko <> | Date | Wed, 18 Mar 2015 23:27:34 +0100 | Subject | Re: PANIC: double fault, error_code: 0x0 in 4.0.0-rc3-2, kvm related? |
| |
On Wed, Mar 18, 2015 at 11:20 PM, Andy Lutomirski <luto@amacapital.net> wrote: >> There is an easy way to test the theory that SYSRET is to blame. >> >> Just replace >> >> movq RCX(%rsp),%rcx >> cmpq %rcx,RIP(%rsp) /* RCX == RIP */ >> jne opportunistic_sysret_failed >> >> this "jne" with "jmp", and try to reproduce. >> > > This is a classic root exploit, and it's why we check for > non-canonical RIP. In theory, that's the only way this can happen. > Intel screwed up -- AMD never fails SYSRET.
I'm not saying the code needs to be changed.
I'm saying that *people who see the crash* can make this change, run the modified kernel, and if crash disappears - then it is caused by "opportunistic SYSRET".
| |