Re: desc v0.61 found a 2.5 kernel bug

[Gabriel Paubert]

On Sun, Apr 27, 2003 at 05:09:04PM -0400, Chuck Ebbert wrote:
> 
> 
> desc v0.61 running on Linux 2.5.68-rel:
> 
>  GDT at c0306300, 32 entries:
> 
> GDT# 12: base:00000000 limit:ffffffff  flags:c09b <P:1 DPL:0 32-bit Code>
> GDT# 13: base:00000000 limit:ffffffff  flags:c093 <P:1 DPL:0 RW Data>
> GDT# 14: base:00000000 limit:ffffffff  flags:c0fb <P:1 DPL:3 32-bit Code>
> GDT# 15: base:00000000 limit:ffffffff  flags:c0f3 <P:1 DPL:3 RW Data>
> GDT# 16: base:c0353800 limit:000eb     flags:008b <P:1 DPL:0 Busy TSS>
> 
>     TSS at c0353800, 236 bytes:
> 
>    CS:0000 <GDT#00,RPL0>   EIP:00000000   eflags:00000000
>   SS0:0068 <GDT#13,RPL0>  ESP0:c2806000
>    SS:0000 <GDT#00,RPL0>   ESP:00000000
>    DS:0000 <GDT#00,RPL0>  ES:0000 <GDT#00,RPL0>
>    FS:0000 <GDT#00,RPL0>  GS:0000 <GDT#00,RPL0>
>   LDT:0011 <GDT#02,RPL1>   CR3:00000000
>       ^^^^                     ^^^^^^^^
> 
> 
>  The LDT in the kernel's TSS is wrong -- it's shifted right by three

It would only be used if we ever performed a hardware task switch
back to the kernel's default TSS. However, it's clearly wrong.
> 
> bits and should be 0088 <GDT entry #17, RPL 0>
> 
>  And shouldn't CR3 be intitialized in case anyone actually wants to
> switch back to the kernel TSS?

For now no, since the only task gate ever taken (double fault), never
returns (you don't want to update the TSS's CR3 field on every 
switch_to() so you would have to do it in the task gate return 
path, as well as having a correct LDT field).

However, returning from a task gate is so much fraught with races wrt 
segment registers that the best thing to do is to avoid it. Read out 
the details on how segment registers are reloaded on a hardware task 
switch to convince yourself.

	Gabriel

> 
> 
> ------
>  Chuck
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [e-mail]
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/