[Bug 265889] sys.kern.basic_signal.trap_signal_test crashes bhyve in i386 VM

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=265889

--- Comment #5 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=dc4a2d1d0e838579f21d9d1fef8655f902f06ab2

commit dc4a2d1d0e838579f21d9d1fef8655f902f06ab2
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2022-08-19 01:26:37 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2022-08-24 19:11:57 +0000

    i386: do not allow userspace to set tf_trapno on sigreturn(2)

    tf_trapno is checked on return from interrupt/exception to determine if
    special handling is needed for switching address space.  This is due to
    the possibility of NMI/MCHK/DBG to occur at arbitrary place in kernel,
    where both address space and stack used could be transient.  Kernel
    saves current %cr3 in tf_err for such events, to restore on return.

    If user is able to set tf_trapno, it can trigger that special handling,
    and since tf_err is also user-controlled by sigreturn(2), the result is
    undefined.

    PR:     265889
    Reported by:    lwhsu
    Reviewed by:    jhb
    Tested by:      pho
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D36302

 sys/i386/i386/exec_machdep.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
You are receiving this mail because:
You are the assignee for the bug.