DF-5732 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 | diff --git a/sys/ddb/ddb.h b/sys/ddb/ddb.h index 1111111..2222222 100644 --- a/sys/ddb/ddb.h +++ b/sys/ddb/ddb.h @@ -93,6 +93,12 @@ db_addr_t db_disasm (db_addr_t loc, boolean_t altfmt, db_regs_t *regs); int db_expression (db_expr_t *valuep); int db_get_variable (db_expr_t *valuep); +/* + * DDB no-fault guard (see sys/platform/pc64/x86_64/db_interface.c). + * Used by trap() to recover DDB memory probes quietly instead of + * routing them through trap_fatal(). + */ +boolean_t db_nofault_pending (void); +void db_nofault_take (void) __dead2; diff --git a/sys/platform/pc64/x86_64/db_interface.c b/sys/platform/pc64/x86_64/db_interface.c index 1111111..2222222 100644 --- a/sys/platform/pc64/x86_64/db_interface.c +++ b/sys/platform/pc64/x86_64/db_interface.c @@ -140,6 +140,22 @@ kdb_trap(int type, int code, struct trapframe *regs) } } +/* + * Accessors for trap(): let a fault covered by the DDB no-fault guard + * (db_read_bytes()/db_write_bytes() probing bad memory from a ddb + * command) recover QUIETLY via the guard's longjmp, instead of first + * running trap_fatal() (crash banner, register disclosure, leaked + * gd_trap_nesting_level, corrupted session-resume state). + */ +boolean_t +db_nofault_pending(void) +{ + return (db_nofault != NULL); +} + +void +db_nofault_take(void) +{ + jmp_buf *no_fault = db_nofault; + + db_nofault = NULL; + longjmp(*no_fault, 1); +} + /* * This handles unexpected traps in ddb commands, including calls to * non-ddb functions. db_nofault only applies to memory accesses by diff --git a/sys/platform/pc64/x86_64/trap.c b/sys/platform/pc64/x86_64/trap.c index 1111111..2222222 100644 --- a/sys/platform/pc64/x86_64/trap.c +++ b/sys/platform/pc64/x86_64/trap.c @@ -413,8 +413,17 @@ trap(struct trapframe *frame) #ifdef DDB /* - * We need to allow T_DNA faults when the debugger is active since - * some dumping paths do large bcopy() which use the floating - * point registers for faster copying. + * If the faulting access is covered by DDB's db_nofault guard + * (db_read_bytes()/db_write_bytes() probing bad memory from a ddb + * command), take the guard's longjmp BEFORE anything else: running + * trap_fatal() first turns a quietly-recoverable debugger probe into + * a spurious crash banner, leaks gd_trap_nesting_level (the longjmp + * skips the decrement below), and corrupts the session-resume path. + */ + if (db_active && frame->tf_trapno != T_DNA && db_nofault_pending()) + db_nofault_take(); + + /* + * We need to allow T_DNA faults when the debugger is active since + * some dumping paths do large bcopy() which use the floating + * point registers for faster copying. */ if (db_active && frame->tf_trapno != T_DNA) { eva = (frame->tf_trapno == T_PAGEFLT ? frame->tf_addr : 0); diff --git a/sys/platform/vkernel64/x86_64/db_interface.c b/sys/platform/vkernel64/x86_64/db_interface.c index 1111111..2222222 100644 --- a/sys/platform/vkernel64/x86_64/db_interface.c +++ b/sys/platform/vkernel64/x86_64/db_interface.c @@ -140,6 +140,22 @@ kdb_trap(int type, int code, struct trapframe *regs) } } +boolean_t +db_nofault_pending(void) +{ + return (db_nofault != NULL); +} + +void +db_nofault_take(void) +{ + jmp_buf *no_fault = db_nofault; + + db_nofault = NULL; + longjmp(*no_fault, 1); +} + /* * This handles unexpected traps in ddb commands, including calls to * non-ddb functions. db_nofault only applies to memory accesses by diff --git a/sys/platform/vkernel64/x86_64/trap.c b/sys/platform/vkernel64/x86_64/trap.c index 1111111..2222222 100644 --- a/sys/platform/vkernel64/x86_64/trap.c +++ b/sys/platform/vkernel64/x86_64/trap.c @@ -1,1 +1,1 @@ (apply the same db_nofault_pending()/db_nofault_take() pre-check in the vkernel64 trap() DDB funnel, mirroring pc64) |