From owner-dev-commits-src-all@freebsd.org Mon Jun 14 21:34:35 2021 Return-Path: Delivered-To: dev-commits-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 9CD0C654CC1; Mon, 14 Jun 2021 21:34:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4G3l8W3dYHz3Gm0; Mon, 14 Jun 2021 21:34:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 596B21C417; Mon, 14 Jun 2021 21:34:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 15ELYZDk067458; Mon, 14 Jun 2021 21:34:35 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 15ELYZpJ067457; Mon, 14 Jun 2021 21:34:35 GMT (envelope-from git) Date: Mon, 14 Jun 2021 21:34:35 GMT Message-Id: <202106142134.15ELYZpJ067457@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 70dd5eebc025 - main - amd64: Fix propagation of LDT updates MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 70dd5eebc025badb7b835dfee3915d8b5f1e7468 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Jun 2021 21:34:35 -0000 The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=70dd5eebc025badb7b835dfee3915d8b5f1e7468 commit 70dd5eebc025badb7b835dfee3915d8b5f1e7468 Author: Mark Johnston AuthorDate: 2021-06-14 21:32:18 +0000 Commit: Mark Johnston CommitDate: 2021-06-14 21:32:18 +0000 amd64: Fix propagation of LDT updates When a process has used sysarch(2) to specify descriptors for its private LDT, upon rfork(RFMEM) descriptors are copied into the new child process. Any updates to the descriptors are thus reflected to all other processes sharing the vmspace. However, this is incorrect in the rather obscure case where the child process was created before the LDT was modified. Fix this by only modifying other processes which already share the LDT. Reported by: syzkaller Reviewed by: kib MFC after: 1 week Sponsored by: The FreeBSD Foundation --- sys/amd64/amd64/sys_machdep.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/sys/amd64/amd64/sys_machdep.c b/sys/amd64/amd64/sys_machdep.c index 5a0145e76ccd..c10b15896132 100644 --- a/sys/amd64/amd64/sys_machdep.c +++ b/sys/amd64/amd64/sys_machdep.c @@ -492,15 +492,19 @@ set_user_ldt(struct mdproc *mdp) } static void -set_user_ldt_rv(struct vmspace *vmsp) +set_user_ldt_rv(void *arg) { - struct thread *td; + struct proc *orig, *target; + struct proc_ldt *ldt; + + orig = arg; + target = curthread->td_proc; - td = curthread; - if (vmsp != td->td_proc->p_vmspace) + ldt = (void *)atomic_load_acq_ptr((uintptr_t *)&orig->p_md.md_ldt); + if (target->p_md.md_ldt != ldt) return; - set_user_ldt(&td->td_proc->p_md); + set_user_ldt(&target->p_md); } struct proc_ldt * @@ -550,8 +554,7 @@ user_ldt_alloc(struct proc *p, int force) atomic_thread_fence_rel(); mdp->md_ldt = new_ldt; critical_exit(); - smp_rendezvous(NULL, (void (*)(void *))set_user_ldt_rv, NULL, - p->p_vmspace); + smp_rendezvous(NULL, set_user_ldt_rv, NULL, p); return (mdp->md_ldt); }