Page MenuHomeFreeBSD

amd64: Clear the local TSS when creating a new thread
ClosedPublic

Authored by markj on Jun 1 2021, 10:27 PM.

Details

Summary

Otherwise it is copied from the creating thread. Then, if either thread
exits, the other is left with a dangling pointer, typically resulting in
a page fault upon the next context switch. This is equivalent to our
behaviour on i386.

Reported by: syzkaller

Test Plan

syzkaller generated a test case where a thread

  • calls sysarch(AMD64_SET_IOPERM)
  • creates a new thread

when the new thread exits, the current thread triggers
a page fault when reloading the TSS during a context switch.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.