[Xen-devel] do_iret bug in xen

["Ashish Bijlani" <ashish.bijlani@xxxxxxxxx>]

"do_iret" (slow iret via hyercall) can introduce a race condition as "current" can change during the execution of the function. all hypercalls run with "sti" on, so an interrupt on a processor causing the control to enter in "__enter_scheduler" after reading current can change the current process on that processor. 

code excerpt 

"
    struct iret_context iret_saved;
    struct vcpu *v = current;

    if ( unlikely(copy_from_user(&iret_saved, (void *)regs->rsp,
                                 sizeof(iret_saved))) )
    {

"

Any thoughts on this?
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel