Date: Mon, 30 Jul 2018 02:53:01 +0300 From: Konstantin Belousov <kostikbel@gmail.com> To: Oliver Pinter <oliver.pinter@hardenedbsd.org> Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r336876 - in head/sys: amd64/amd64 amd64/ia32 amd64/include conf dev/hyperv/vmbus/amd64 Message-ID: <20180729235301.GM40119@kib.kiev.ua> In-Reply-To: <CAPQ4ffsWKQG9vAna9ORefNW1DYBv4=32s0TDLTe%2Bi6BB96vrdw@mail.gmail.com> References: <201807292047.w6TKl0hV004691@repo.freebsd.org> <CAPQ4ffsHqf8OiqUF-WBJ_0KbZGgAOs-6npyLjqWYFN%2BoCq=8Pw@mail.gmail.com> <20180729223158.GL40119@kib.kiev.ua> <CAPQ4ffsWKQG9vAna9ORefNW1DYBv4=32s0TDLTe%2Bi6BB96vrdw@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jul 30, 2018 at 01:26:51AM +0200, Oliver Pinter wrote: > On 7/30/18, Konstantin Belousov <kostikbel@gmail.com> wrote: > >> testq %r9,%r9 > >> jz 1f > >> subq %rdx,%r8 > >> movq %r8,(%r9) << Here you access user-space, with cleared > >> RFLAGS.AC from the fault handler. > > How does this instruction access userspace ? I do not see. > > As far as I remember from 4 years, the r9 may contained a user-space > address in 10-STABLE > in the case of starting the init. I've a stac/clac pair in my internal > version, but I haven't found > yet the relevant commit message. This does not make any sense at all. What could be a use for copyinstr(9) to pass a userspace pointer to return the copied string' length ? More, kernel must not directly access userspace, it needs to prepare for these accesses to fault.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20180729235301.GM40119>