From 9eb958988a31a375385b4ff1088ab9da6e55c2de Mon Sep 17 00:00:00 2001 From: Konstantin Belousov Date: Sun, 2 Sep 2018 20:07:36 +0000 Subject: Swap order of dererencing PCPU curpmap and checking for usermode in trap_pfault() KPTI violation check. EFI RT may set curpmap to NULL for the duration of the call for some machines (PCID but no INVPCID). Since apparently EFI RT code must be ready for exceptions from the calls, avoid dereferencing curpmap until we know that this call does not come from usermode. Reviewed by: kevans Sponsored by: The FreeBSD Foundation MFC after: 1 week Approved by: re (rgrimes) Differential revision: https://reviews.freebsd.org/D16972 --- sys/amd64/amd64/trap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sys') diff --git a/sys/amd64/amd64/trap.c b/sys/amd64/amd64/trap.c index 019decb837ac..4d03da234f19 100644 --- a/sys/amd64/amd64/trap.c +++ b/sys/amd64/amd64/trap.c @@ -806,7 +806,7 @@ trap_pfault(struct trapframe *frame, int usermode) * If nx protection of the usermode portion of kernel page * tables caused trap, panic. */ - if (PCPU_GET(curpmap)->pm_ucr3 != PMAP_NO_CR3 && usermode && + if (usermode && PCPU_GET(curpmap)->pm_ucr3 != PMAP_NO_CR3 && pg_nx != 0 && (frame->tf_err & (PGEX_P | PGEX_W | PGEX_U | PGEX_I)) == (PGEX_P | PGEX_U | PGEX_I) && (curpcb->pcb_saved_ucr3 & ~CR3_PCID_MASK)== -- cgit v1.2.3