Re: FSGSBASE causing panic on 5.9-rc1

From: Bae, Chang Seok
Date: Thu Aug 20 2020 - 14:43:26 EST



> On Aug 20, 2020, at 08:21, Tom Lendacky <thomas.lendacky@xxxxxxx> wrote:
> On 8/20/20 10:10 AM, Sean Christopherson wrote:
>>
>> Pretty sure current->thread.gsbase can be stale, i.e. this needs:
>> current_save_fsgs();
>
> I did try adding current_save_fsgs() in svm_vcpu_load(), saving the current->thread.gsbase value to a new variable in the svm struct. I then used that variable in the wrmsrl below, but it still crashed.

Then, current->thread.gsbase is from __rdgsbase_inactive() which is
user GSBASE.

If you do the wrmsrl below, it overwrites the current GSBASE with the
user value.

>> wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gsbase);

Thanks,
Chang