lkml.org 
[lkml]   [2019]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [patch V2 14/16] x86/iopl: Restrict iopl() permission scope
On Mon, 11 Nov 2019, Thomas Gleixner wrote:
> --- a/arch/x86/kernel/ioport.c
> +++ b/arch/x86/kernel/ioport.c
> @@ -27,15 +27,28 @@ void io_bitmap_share(struct task_struct
> set_tsk_thread_flag(tsk, TIF_IO_BITMAP);
> }
>
> +static void task_update_io_bitmap(void)
> +{
> + struct thread_struct *t = &current->thread;
> +
> + preempt_disable();
> + if (t->iopl_emul == 3 || t->io_bitmap) {
> + /* TSS update is handled on exit to user space */
> + set_thread_flag(TIF_IO_BITMAP);
> + } else {
> + clear_thread_flag(TIF_IO_BITMAP);
> + /* Invalidate TSS */
> + tss_update_io_bitmap();
> + }
> + preempt_enable();
> +}
> +
> void io_bitmap_exit(void)
> {
> struct io_bitmap *iobm = current->thread.io_bitmap;
>
> - preempt_disable();
> current->thread.io_bitmap = NULL;
> - clear_thread_flag(TIF_IO_BITMAP);
> - tss_update_io_bitmap();
> - preempt_enable();
> + task_update_io_bitmap();
> if (iobm && refcount_dec_and_test(&iobm->refcnt))
> kfree(iobm);

This obviously needs the following delta to be folded in. Noticed too late
after fiddling with the test case some more. git tree is updated
accordingly.

Thanks,

tglx
---
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
@@ -18,12 +18,15 @@ static atomic64_t io_bitmap_sequence;

void io_bitmap_share(struct task_struct *tsk)
{
- /*
- * Take a refcount on current's bitmap. It can be used by
- * both tasks as long as none of them changes the bitmap.
- */
- refcount_inc(&current->thread.io_bitmap->refcnt);
- tsk->thread.io_bitmap = current->thread.io_bitmap;
+ /* Can be NULL when current->thread.iopl_emul == 3 */
+ if (current->thread.io_bitmap) {
+ /*
+ * Take a refcount on current's bitmap. It can be used by
+ * both tasks as long as none of them changes the bitmap.
+ */
+ refcount_inc(&current->thread.io_bitmap->refcnt);
+ tsk->thread.io_bitmap = current->thread.io_bitmap;
+ }
set_tsk_thread_flag(tsk, TIF_IO_BITMAP);
}

\
 
 \ /
  Last update: 2019-11-12 00:05    [W:0.272 / U:0.492 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site