Re: [Xen-devel] [PATCH v4 0/3] x86: modify_ldt improvement, test, and config option

[Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>]

On 07/27/2015 11:53 AM, Andy Lutomirski wrote:
> On Mon, Jul 27, 2015 at 8:36 AM, Boris Ostrovsky
> <boris.ostrovsky@xxxxxxxxxx> wrote:
> > On 07/25/2015 01:36 AM, Andy Lutomirski wrote:
> > > Here's v3.  It fixes the "dazed and confused" issue, I hope.  It's also
> > > probably a good general attack surface reduction, and it replaces some
> > > scary code with IMO less scary code.
> > >
> > > Also, servers and embedded systems should probably turn off modify_ldt.
> > > This makes that possible.
> > >
> > > Xen people, can you take a look at this?
> > >
> > > Willy and Kees: I left the config option alone.  The -tiny people will
> > > like it, and we can always add a sysctl of some sort later.
> > >
> > > Changes from v3:
> > >    - Hopefully fixed Xen.
> > 32b-on-32b fails in the same manner. (but non-zero LDT is taken care of)
> >
> > >    - Fixed 32-bit test case on 32-bit native kernel.
> > I am not sure I see what changed.
> I misplaced the fix in the wrong git commit, so I failed to sent it.  Oops.
>
> I just sent v4.1 of patch 3.  Can you try that?

I am hitting BUG() in Xen code (returning from a hypercall) when freeing 
LDT in destroy_context(). Interestingly though when I run the test in 
the debugger I get SIGILL (just like before) but no BUG().
Let me get back to you on that later today.


-boris

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel