Messages in this thread Patch in this message |  | | Date | Tue, 12 Nov 2019 00:03:53 +0100 (CET) | From | Thomas Gleixner <> | Subject | Re: [patch V2 14/16] x86/iopl: Restrict iopl() permission scope |
| |
On Mon, 11 Nov 2019, Thomas Gleixner wrote: > --- a/arch/x86/kernel/ioport.c > +++ b/arch/x86/kernel/ioport.c > @@ -27,15 +27,28 @@ void io_bitmap_share(struct task_struct > set_tsk_thread_flag(tsk, TIF_IO_BITMAP); > } > > +static void task_update_io_bitmap(void) > +{ > + struct thread_struct *t = ¤t->thread; > + > + preempt_disable(); > + if (t->iopl_emul == 3 || t->io_bitmap) { > + /* TSS update is handled on exit to user space */ > + set_thread_flag(TIF_IO_BITMAP); > + } else { > + clear_thread_flag(TIF_IO_BITMAP); > + /* Invalidate TSS */ > + tss_update_io_bitmap(); > + } > + preempt_enable(); > +} > + > void io_bitmap_exit(void) > { > struct io_bitmap *iobm = current->thread.io_bitmap; > > - preempt_disable(); > current->thread.io_bitmap = NULL; > - clear_thread_flag(TIF_IO_BITMAP); > - tss_update_io_bitmap(); > - preempt_enable(); > + task_update_io_bitmap(); > if (iobm && refcount_dec_and_test(&iobm->refcnt)) > kfree(iobm);
This obviously needs the following delta to be folded in. Noticed too late after fiddling with the test case some more. git tree is updated accordingly.
Thanks,
tglx --- --- a/arch/x86/kernel/ioport.c +++ b/arch/x86/kernel/ioport.c @@ -18,12 +18,15 @@ static atomic64_t io_bitmap_sequence; void io_bitmap_share(struct task_struct *tsk) { - /* - * Take a refcount on current's bitmap. It can be used by - * both tasks as long as none of them changes the bitmap. - */ - refcount_inc(¤t->thread.io_bitmap->refcnt); - tsk->thread.io_bitmap = current->thread.io_bitmap; + /* Can be NULL when current->thread.iopl_emul == 3 */ + if (current->thread.io_bitmap) { + /* + * Take a refcount on current's bitmap. It can be used by + * both tasks as long as none of them changes the bitmap. + */ + refcount_inc(¤t->thread.io_bitmap->refcnt); + tsk->thread.io_bitmap = current->thread.io_bitmap; + } set_tsk_thread_flag(tsk, TIF_IO_BITMAP); }
|  |