Bug 265889 - sys.kern.basic_signal.trap_signal_test crashes bhyve in i386 VM
Summary: sys.kern.basic_signal.trap_signal_test crashes bhyve in i386 VM
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: tests (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-testing (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-08-16 21:59 UTC by Li-Wen Hsu
Modified: 2022-11-09 19:35 UTC (History)
1 user (show)

See Also:


Attachments
reproduce code (820 bytes, text/plain)
2022-08-16 21:59 UTC, Li-Wen Hsu
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Li-Wen Hsu freebsd_committer freebsd_triage 2022-08-16 21:59:01 UTC
This test added in base 31cf95cec738bdb51a652689e2f829addc3b984b and MFC'd to stable/13 in base 598e53b3d39c5b8453151080db3ccc263a04330f , it crashes an i386 VM in bhyve.
Comment 1 Li-Wen Hsu freebsd_committer freebsd_triage 2022-08-16 21:59:50 UTC
Created attachment 235951 [details]
reproduce code
Comment 2 commit-hook freebsd_committer freebsd_triage 2022-08-16 22:06:29 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=c04721e35ff0e8220c88d5b10f068dba18629f7e

commit c04721e35ff0e8220c88d5b10f068dba18629f7e
Author:     Li-Wen Hsu <lwhsu@FreeBSD.org>
AuthorDate: 2022-08-16 22:03:37 +0000
Commit:     Li-Wen Hsu <lwhsu@FreeBSD.org>
CommitDate: 2022-08-16 22:03:37 +0000

    basic_signal test: temporarily skip trap_signal_test on i386

    This case crashes a bhyve VM.

    PR:             265889
    Sponsored by:   The FreeBSD Foundation

 tests/sys/kern/basic_signal.c | 4 ++++
 1 file changed, 4 insertions(+)
Comment 3 commit-hook freebsd_committer freebsd_triage 2022-08-17 00:16:51 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=beeeb40bca06c8ebc8953274bbc5759fb432fab2

commit beeeb40bca06c8ebc8953274bbc5759fb432fab2
Author:     Li-Wen Hsu <lwhsu@FreeBSD.org>
AuthorDate: 2022-08-17 00:15:10 +0000
Commit:     Li-Wen Hsu <lwhsu@FreeBSD.org>
CommitDate: 2022-08-17 00:15:10 +0000

    basic_signal test: really skip trap_signal_test on i386

    PR:             265889
    Fixes:          c04721e35ff0e8220c88d5b10f068dba18629f7e
    Sponsored by:   The FreeBSD Foundation

 tests/sys/kern/basic_signal.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
Comment 4 commit-hook freebsd_committer freebsd_triage 2022-08-17 00:20:53 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=66ea3876d70b7a205f64962d743324f65edec22e

commit 66ea3876d70b7a205f64962d743324f65edec22e
Author:     Li-Wen Hsu <lwhsu@FreeBSD.org>
AuthorDate: 2022-08-16 22:03:37 +0000
Commit:     Li-Wen Hsu <lwhsu@FreeBSD.org>
CommitDate: 2022-08-17 00:18:46 +0000

    basic_signal test: temporarily skip trap_signal_test on i386

    This case crashes a bhyve VM.

    PR:             265889
    Sponsored by:   The FreeBSD Foundation

    (cherry picked from commit c04721e35ff0e8220c88d5b10f068dba18629f7e)
    (cherry picked from commit beeeb40bca06c8ebc8953274bbc5759fb432fab2)

 tests/sys/kern/basic_signal.c | 4 ++++
 1 file changed, 4 insertions(+)
Comment 5 commit-hook freebsd_committer freebsd_triage 2022-08-24 19:25:40 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=dc4a2d1d0e838579f21d9d1fef8655f902f06ab2

commit dc4a2d1d0e838579f21d9d1fef8655f902f06ab2
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2022-08-19 01:26:37 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2022-08-24 19:11:57 +0000

    i386: do not allow userspace to set tf_trapno on sigreturn(2)

    tf_trapno is checked on return from interrupt/exception to determine if
    special handling is needed for switching address space.  This is due to
    the possibility of NMI/MCHK/DBG to occur at arbitrary place in kernel,
    where both address space and stack used could be transient.  Kernel
    saves current %cr3 in tf_err for such events, to restore on return.

    If user is able to set tf_trapno, it can trigger that special handling,
    and since tf_err is also user-controlled by sigreturn(2), the result is
    undefined.

    PR:     265889
    Reported by:    lwhsu
    Reviewed by:    jhb
    Tested by:      pho
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D36302

 sys/i386/i386/exec_machdep.c | 3 +++
 1 file changed, 3 insertions(+)
Comment 6 commit-hook freebsd_committer freebsd_triage 2022-08-25 04:16:55 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=9ea2716b7758b72725b932f1ad9f3457a69cbea6

commit 9ea2716b7758b72725b932f1ad9f3457a69cbea6
Author:     Li-Wen Hsu <lwhsu@FreeBSD.org>
AuthorDate: 2022-08-25 04:09:00 +0000
Commit:     Li-Wen Hsu <lwhsu@FreeBSD.org>
CommitDate: 2022-08-25 04:09:00 +0000

    Reenable basic_signal:trap_signal_test on i386

    This is fixed in dc4a2d1d0e838579f21d9d1fef8655f902f06ab2

    PR:             265889
    Sponsored by:   The FreeBSD Foundation
    MFC with:       dc4a2d1d0e838579f21d9d1fef8655f902f06ab2

 tests/sys/kern/basic_signal.c | 4 ----
 1 file changed, 4 deletions(-)
Comment 7 commit-hook freebsd_committer freebsd_triage 2022-08-31 01:33:28 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=cd304fdbe95b844f4dff5cd40d213f6923c8767b

commit cd304fdbe95b844f4dff5cd40d213f6923c8767b
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2022-08-19 01:26:37 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2022-08-31 01:20:27 +0000

    i386: do not allow userspace to set tf_trapno on sigreturn(2)

    PR:     265889

    (cherry picked from commit dc4a2d1d0e838579f21d9d1fef8655f902f06ab2)

 sys/i386/i386/exec_machdep.c | 3 +++
 1 file changed, 3 insertions(+)
Comment 8 commit-hook freebsd_committer freebsd_triage 2022-11-09 19:34:46 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=af3ccd7b6d427ab2d419b8500d71392ead2e7eb9

commit af3ccd7b6d427ab2d419b8500d71392ead2e7eb9
Author:     Li-Wen Hsu <lwhsu@FreeBSD.org>
AuthorDate: 2022-08-25 04:09:00 +0000
Commit:     Li-Wen Hsu <lwhsu@FreeBSD.org>
CommitDate: 2022-11-09 19:34:02 +0000

    Reenable basic_signal:trap_signal_test on i386

    This is fixed in dc4a2d1d0e838579f21d9d1fef8655f902f06ab2

    PR:             265889
    Sponsored by:   The FreeBSD Foundation
    MFC with:       dc4a2d1d0e838579f21d9d1fef8655f902f06ab2

    (cherry picked from commit 9ea2716b7758b72725b932f1ad9f3457a69cbea6)

 tests/sys/kern/basic_signal.c | 4 ----
 1 file changed, 4 deletions(-)