git: 8cd05b883330 - main - amd64: Clear the local TSS when creating a new thread

[Mark Johnston]

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=8cd05b883330049d536a40e2f4c9ff92d0e6944e

commit 8cd05b883330049d536a40e2f4c9ff92d0e6944e
Author:     Mark Johnston <markj at FreeBSD.org>
AuthorDate: 2021-06-01 23:38:22 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-06-01 23:38:22 +0000

    amd64: Clear the local TSS when creating a new thread
    
    Otherwise it is copied from the creating thread.  Then, if either thread
    exits, the other is left with a dangling pointer, typically resulting in
    a page fault upon the next context switch.
    
    Reported by:    syzkaller
    Reviewed by:    kib
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D30607
---
 sys/amd64/amd64/vm_machdep.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/amd64/amd64/vm_machdep.c b/sys/amd64/amd64/vm_machdep.c
index 1acc5dc55c85..7d65269410e0 100644
--- a/sys/amd64/amd64/vm_machdep.c
+++ b/sys/amd64/amd64/vm_machdep.c
@@ -189,6 +189,8 @@ copy_thread(struct thread *td1, struct thread *td2)
 	 * pcb2->pcb_[fg]sbase:	cloned above
 	 */
 
+	pcb2->pcb_tssp = NULL;
+
 	/* Setup to release spin count in fork_exit(). */
 	td2->td_md.md_spinlock_count = 1;
 	td2->td_md.md_saved_flags = PSL_KERNEL | PSL_I;