linux-hardened/drivers/lguest
Suresh Siddha 54481cf88b x86: fix NULL pointer deref in __switch_to
I am able to reproduce the oops reported by Simon in __switch_to() with
lguest.

My debug showed that there is at least one lguest specific
issue (which should be present in 2.6.25 and before aswell) and it got
exposed with a kernel oops with the recent fpu dynamic allocation patches.

In addition to the previous possible scenario (with fpu_counter), in the
presence of lguest, it is possible that the cpu's TS bit it still set and the
lguest launcher task's thread_info has TS_USEDFPU still set.

This is because of the way the lguest launcher handling the guest's TS bit.
(look at lguest_set_ts() in lguest_arch_run_guest()). This can result
in a DNA fault while doing unlazy_fpu() in __switch_to(). This will
end up causing a DNA fault in the context of new process thats
getting context switched in (as opossed to handling DNA fault in the context
of lguest launcher/helper process).

This is wrong in both pre and post 2.6.25 kernels. In the recent
2.6.26-rc series, this is showing up as NULL pointer dereferences or
sleeping function called from atomic context(__switch_to()), as
we free and dynamically allocate the FPU context for the newly
created threads. Older kernels might show some FPU corruption for processes
running inside of lguest.

With the appended patch, my test system is running for more than 50 mins
now. So atleast some of your oops (hopefully all!) should get fixed.
Please give it a try. I will spend more time with this fix tomorrow.

Reported-by: Simon Holm Thøgersen <odie@cs.aau.dk>
Reported-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
2008-06-20 13:26:18 +02:00
..
x86 x86: fix NULL pointer deref in __switch_to 2008-06-20 13:26:18 +02:00
core.c lguest: comment documentation update. 2008-03-28 11:05:54 +11:00
hypercalls.c lguest: comment documentation update. 2008-03-28 11:05:54 +11:00
interrupts_and_traps.c lguest: comment documentation update. 2008-03-28 11:05:54 +11:00
Kconfig Remove bogus duplicate CONFIG_LGUEST_GUEST entry. 2008-01-19 21:29:39 -08:00
lg.h drivers: Remove unnecessary inclusions of asm/semaphore.h 2008-04-18 22:16:32 -04:00
lguest_device.c virtio: set device index in common code. 2008-05-30 15:09:42 +10:00
lguest_user.c lguest: remove bogus NULL cpu check 2008-05-02 21:50:52 +10:00
Makefile lguest: Add puppies which where previously missing. 2008-03-28 11:05:52 +11:00
page_tables.c lguest: comment documentation update. 2008-03-28 11:05:54 +11:00
README lguest: documentation I: Preparation 2007-07-26 11:35:16 -07:00
segments.c lguest: get rid of lg variable assignments 2008-01-30 22:50:18 +11:00

Welcome, friend reader, to lguest.

Lguest is an adventure, with you, the reader, as Hero.  I can't think of many
5000-line projects which offer both such capability and glimpses of future
potential; it is an exciting time to be delving into the source!

But be warned; this is an arduous journey of several hours or more!  And as we
know, all true Heroes are driven by a Noble Goal.  Thus I offer a Beer (or
equivalent) to anyone I meet who has completed this documentation.

So get comfortable and keep your wits about you (both quick and humorous).
Along your way to the Noble Goal, you will also gain masterly insight into
lguest, and hypervisors and x86 virtualization in general.

Our Quest is in seven parts: (best read with C highlighting turned on)

I) Preparation
	- In which our potential hero is flown quickly over the landscape for a
	  taste of its scope.  Suitable for the armchair coders and other such
	  persons of faint constitution.

II) Guest
	- Where we encounter the first tantalising wisps of code, and come to
	  understand the details of the life of a Guest kernel.

III) Drivers
	- Whereby the Guest finds its voice and become useful, and our
	  understanding of the Guest is completed.

IV) Launcher
	- Where we trace back to the creation of the Guest, and thus begin our
	  understanding of the Host.

V) Host
	- Where we master the Host code, through a long and tortuous journey.
	  Indeed, it is here that our hero is tested in the Bit of Despair.

VI) Switcher
	- Where our understanding of the intertwined nature of Guests and Hosts
	  is completed.

VII) Mastery
	- Where our fully fledged hero grapples with the Great Question:
	  "What next?"

make Preparation!
Rusty Russell.