Segmentation fault in ldt_gdt_64
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Trusty |
Fix Released
|
Undecided
|
Juerg Haefliger |
Bug Description
== SRU Justification ==
The ldt_gdt_64 x86 selftest segfaults with the currently released Trusty 3.13 kernel. The commit that introduced the segfault is aeb315d60afe ("x86/ldt: Make modify_ldt synchronous").
== Fix ==
Upstream commit 8ff5bd2e1e27 ("x86/signal/64: Fix SS if needed when delivering a 64-bit signal"). This commit was found by doing a reverse git bisect of the upstream kernel (i.e., when did the test stop segfaulting).
The backport of the commit is a simple context adjustment. The second commit is a pre-requisite which simply renames some defines (no functional changes).
== Regression Potential ==
Low. The commit is very small and isolated and the code path is only executed in special circumstances (and for x86 only). I built a test kernel and ran the whole set of x86 selftests and perf NMI test for several hours to verify stability.
== Test Case ==
Run the ldt_gdt_64 x86 selftets from a current upstream kernel source. The test segfaults consistently.
Original bug description:
Trusty 3.13 segfaults when running ldt_gdt_64 from the kernel's x86 selftests.
git bisect revealed that the following commit introduced the issue:
commit aeb315d60afee12
Author: Andy Lutomirski <email address hidden>
Date: Thu Jul 30 14:31:32 2015 -0700
x86/ldt: Make modify_ldt synchronous
CVE-2017-5754
commit 37868fe113ff2ba
modify_ldt() has questionable locking and does not synchronize
threads. Improve it: redesign the locking and synchronize all
threads' LDTs using an IPI on all modifications.
This will dramatically slow down modify_ldt in multithreaded
programs, but there shouldn't be any multithreaded programs that
care about modify_ldt's performance in the first place.
This fixes some fallout from the CVE-2015-5157 fixes.
Signed-off-by: Andy Lutomirski <email address hidden>
Reviewed-by: Borislav Petkov <email address hidden>
Cc: Andrew Cooper <email address hidden>
Cc: Andy Lutomirski <email address hidden>
Cc: Boris Ostrovsky <email address hidden>
Cc: Borislav Petkov <email address hidden>
Cc: Brian Gerst <email address hidden>
Cc: Denys Vlasenko <email address hidden>
Cc: H. Peter Anvin <email address hidden>
Cc: Jan Beulich <email address hidden>
Cc: Konrad Rzeszutek Wilk <email address hidden>
Cc: Linus Torvalds <email address hidden>
Cc: Peter Zijlstra <email address hidden>
Cc: Sasha Levin <email address hidden>
Cc: Steven Rostedt <email address hidden>
Cc: Thomas Gleixner <email address hidden>
Link: http://
Signed-off-by: Ingo Molnar <email address hidden>
Signed-off-by: Jiri Slaby <email address hidden>
(cherry picked from commit 62fc7228f8cc8c8
Signed-off-by: Juerg Haefliger <email address hidden>
Signed-off-by: Stefan Bader <email address hidden>
description: | updated |
Changed in linux (Ubuntu Trusty): | |
assignee: | nobody → Juerg Haefliger (juergh) |
description: | updated |
description: | updated |
description: | updated |
Changed in linux (Ubuntu Trusty): | |
status: | New → Fix Committed |
Changed in linux (Ubuntu): | |
status: | Incomplete → Invalid |
tags: | added: cscc |
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 1755817
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.