diff options
Diffstat (limited to 'results/classifier/zero-shot-user-mode/instruction/1824344')
| -rw-r--r-- | results/classifier/zero-shot-user-mode/instruction/1824344 | 51 |
1 files changed, 51 insertions, 0 deletions
diff --git a/results/classifier/zero-shot-user-mode/instruction/1824344 b/results/classifier/zero-shot-user-mode/instruction/1824344 new file mode 100644 index 00000000..f56b3780 --- /dev/null +++ b/results/classifier/zero-shot-user-mode/instruction/1824344 @@ -0,0 +1,51 @@ +instruction: 0.713 +runtime: 0.195 +syscall: 0.092 + + + +x86: retf or iret pagefault sets wrong error code + +With a x86_64 or i386 guest, non-KVM, when trying to execute a +"iret/iretq/retf" instruction in userspace with invalid stack pointer +(under a protected mode OS, like Linux), wrong bits are set in the +pushed error code; bit 2 is not set, indicating the error comes from +kernel space. + +If the guest OS is using this flag to decide whether this was a kernel +or user page fault, it will mistakenly decide a kernel has irrecoverably +faulted, possibly causing guest OS panic. + + +How to reproduce the problem a guest (non-KVM) Linux: +Note, on recent Linux kernel version, this needs a CPU with SMAP support +(eg. -cpu max) + +$ cat tst.c +int main() +{ +__asm__ volatile ( +"mov $0,%esp\n" +"retf" +); +return 0; +} + +$ gcc tst.c +$ ./a.out +Killed + + +"dmesg" shows the kernel has in fact triggered a "BUG: unable to handle +kernel NULL pointer dereference...", but it has "recovered" by killing +the faulting process (see attached screenshot). + + +Using self-compiled qemu from git: +commit 532cc6da74ec25b5ba6893b5757c977d54582949 (HEAD -> master, tag: v4.0.0-rc3, origin/master, origin/HEAD) +Author: Peter Maydell <email address hidden> +Date: Wed Apr 10 15:38:59 2019 +0100 + + Update version for v4.0.0-rc3 release + + Signed-off-by: Peter Maydell <email address hidden> \ No newline at end of file |