|author||Marco Vanotti <email@example.com>||Tue Apr 28 02:39:21 2020 +0000|
|committer||CQ bot account: firstname.lastname@example.org <email@example.com>||Tue Apr 28 02:39:21 2020 +0000|
[zircon][debugger] Don't write reserved part of mxcsr register. This CL fixes a kernel panic in zircon, in which the `zx_thread_write_state` syscall could overwrite the entire `mxcsr`, including the reserved bits. According to section "10.2.3 MXCSR Control and Status Register" in Intel's Software Developer Manual Volume 1: Basic Architecture, writing a non-zero value to the reserved bits causes a general protection fault. The fix reads the mxcsr_mask from the `x86_xsave_legacy_area` and checks whether the function is trying to write into a non-set bit. Note that it's possible for the mxcsr_mask to be zero, and in that case, the mask is hard-coded to the value 0x0000ffbf, as specified by the intel and amd manuals. If the mxcsr has invalid bits, the function returns `ZX_ERR_INVALID_ARGS`, not copying anything to the fxsave area. I added a unit test to test this behavior: writing all ones to the register would trigger a general protection fault if this fix is not included. To run the test: ``` $ fx set bringup.x64 \ --with-base //garnet/packages/tests:zircon \ --with-base //bundles/bringup:tests ``` And run it with `runtests -t threads-test` BUG=50632 This vulnerability was reported by: Quarkslab : Intel 64 and IA-32 Architectures Software Developer’s Manual Volume 1: Basic Architecture Section: 11.6.6 Guidelines for Writing to the MXCSR Register : AMD64 Architecture Programmer’s Manual Volume 2: System Programming Section: 11.5.9 MXCSR State Management Change-Id: If1794258a086e20beb24591e63d8da87b74b828a Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/383146 Commit-Queue: Marco Vanotti <firstname.lastname@example.org> Reviewed-by: Gianfranco Valentino <email@example.com> Reviewed-by: Venkatesh Srinivas <firstname.lastname@example.org> Reviewed-by: Brett Wilson <email@example.com> Testability-Review: Gianfranco Valentino <firstname.lastname@example.org> Testability-Review: Brett Wilson <email@example.com>
Pink + Purple == Fuchsia (a new operating system)
Fuchsia is a modular, capability-based operating system. Fuchsia runs on modern 64-bit Intel and ARM processors.
Fuchsia is an open source project with a code of conduct that we expect everyone who interacts with the project to respect.
See Getting Started.