[PATCH] x86, vm86: fix preemption bug for int3 breakpoint handlers.

[PATCH] x86, vm86: fix preemption bug for int3 breakpoint handlers.

[Bart Oldeman]

Impact: fix kernel bug such as:
May 22 16:47:47 localhost kernel: note: dosemu.bin[5281] exited with preempt_count 1

Commit be716615fe596ee117292dc615e95f707fb67fd1 ("x86, vm86:
fix preemption bug") fixes the problem for debug exceptions but not
for breakpoints. This change also fixes breakpoints. As the offending
codepath is jumping directly back to entry.S, move the logic to
vm86_32.c, and re-enable preemption in vm86_handle_trap() before
calling return_to_32bit().

Cc: stable@kernel.org
Signed-off-by: Bart Oldeman <bartoldeman@users.sourceforge.net>
---
  arch/x86/kernel/traps.c   |    4 +---
  arch/x86/kernel/vm86_32.c |    6 +++++-
  2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index f07ada4..98ebe1c 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -590,10 +590,8 @@ clear_dr7:

  #ifdef CONFIG_X86_32
  debug_vm86:
-	/* reenable preemption: handle_vm86_trap() might sleep */
-	dec_preempt_count();
  	handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code, 1);
-	conditional_cli(regs);
+	preempt_conditional_cli(regs);
  	return;
  #endif

diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index b8035a0..17c7734 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -551,8 +551,12 @@ cannot_handle:
  int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int trapno)
  {
  	if (VMPI.is_vm86pus) {
-		if ((trapno == 3) || (trapno == 1))
+		if ((trapno == 3) || (trapno == 1)) {
+			/* re-enable preemption: return_to_32bit()
+			   jumps straight to entry_32.S */
+			dec_preempt_count();
  			return_to_32bit(regs, VM86_TRAP + (trapno << 8));
+		}
  		do_int(regs, trapno, (unsigned char __user *) (regs->pt.ss << 4), SP(regs));
  		return 0;
  	}
-- 
1.6.2.4

Re: [PATCH] x86, vm86: fix preemption bug for int3 breakpoint handlers.

[Thomas Gleixner]

Bart,

On Sun, 24 May 2009, Bart Oldeman wrote:
> diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
> index b8035a0..17c7734 100644
> --- a/arch/x86/kernel/vm86_32.c
> +++ b/arch/x86/kernel/vm86_32.c
> @@ -551,8 +551,12 @@ cannot_handle:
>  int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int
> trapno)
>  {
>  	if (VMPI.is_vm86pus) {
> -		if ((trapno == 3) || (trapno == 1))
> +		if ((trapno == 3) || (trapno == 1)) {
> +			/* re-enable preemption: return_to_32bit()
> +			   jumps straight to entry_32.S */
> +			dec_preempt_count();

  This will break other callers of handle_vm86_trap().

Thanks,

	tglx

Re: [PATCH] x86, vm86: fix preemption bug for int3 breakpoint handlers.

[Bart Oldeman]

Thomas,

On Mon, 25 May 2009, Thomas Gleixner wrote:
> On Sun, 24 May 2009, Bart Oldeman wrote:
>> --- a/arch/x86/kernel/vm86_32.c
>> +++ b/arch/x86/kernel/vm86_32.c
>> @@ -551,8 +551,12 @@ cannot_handle:
>>  int handle_vm86_trap(struct kernel_vm86_regs *regs, long error_code, int
>> trapno)
>>  {
>>  	if (VMPI.is_vm86pus) {
>> -		if ((trapno == 3) || (trapno == 1))
>> +		if ((trapno == 3) || (trapno == 1)) {
>> +			/* re-enable preemption: return_to_32bit()
>> +			   jumps straight to entry_32.S */
>> +			dec_preempt_count();
>
>  This will break other callers of handle_vm86_trap().

sorry for the late reply, I was just pointed out by someone else about the
existence of this bug again. You are right of course. Below is a new 
patch.

Note that on the linux-2.6-x86.git tree, commit 
08d68323d1f0c34452e614263b212ca556dae47f ("hw-breakpoints: modifying
generic debug exception to use thread-specific debug registers") broke 
vm86 debug exceptions as well again. The trouble is that 
handle_vm86_trap() may jump and change the stack to let the kernel return 
to 32 bit user space, so the handle_vm86_trap() call itself may not 
return.

--
Impact: fix kernel bug such as:
May 22 16:47:47 localhost kernel: note: dosemu.bin[5281] exited with preempt_count 1

Commit be716615fe596ee117292dc615e95f707fb67fd1 ("x86, vm86:
fix preemption bug"), fixed the problem for debug exceptions but not for 
breakpoints. This change also fixes breakpoints.

Cc: stable@kernel.org
Signed-off-by: Bart Oldeman <bartoldeman@users.sourceforge.net>
---
  arch/x86/kernel/traps.c |    7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)

--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -181,9 +181,14 @@ kernel_trap:

  #ifdef CONFIG_X86_32
  vm86_trap:
+	/* reenable preemption: handle_vm86_trap() might sleep */
+	dec_preempt_count();
  	if (handle_vm86_trap((struct kernel_vm86_regs *) regs,
-						error_code, trapnr))
+						error_code, trapnr)) {
+		inc_preempt_count();
  		goto trap_signal;
+	}
+	inc_preempt_count();
  	return;
  #endif
  }