diff options
| author | Jann Horn <jannh@google.com> | 2020-01-14 22:21:57 +0100 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2020-01-15 16:06:40 +0100 |
| commit | 069a5a4486fb7cae0cb63d04d4799839a497a70b (patch) | |
| tree | 930854ea534730568760ddc676e1382c8632ad28 /executor/executor_linux.h | |
| parent | b67897d4d1e0adbe963dd3bf9ed797586aa88fd1 (diff) | |
pkg/report: add pattern for Linux #SS faults
On X86-64, dereferencing a non-canonical address normally causes a #GP, for
which syzkaller already has a pattern. However, if the base register of the
non-canonical address is RBP (which can happen in builds that use RBP as a
general-purpose register because they don't use frame pointer unwinding),
#SS is thrown instead, for which syzkaller did not yet have a pattern.
To see this kind of fault, you can insert the following code in
kernel_init() after the call to rcu_end_inkernel_boot():
asm volatile(
"movabs $0x8000000000000000, %rbp\n\t"
"movq (%rbp), %rax\n\t"
"ud2\n\t"
);
Linux prints a different error message for #SS, so add that error message
to syzkaller's list of patterns.
Diffstat (limited to 'executor/executor_linux.h')
0 files changed, 0 insertions, 0 deletions
