HExSA-Lab / nautilus

Nautilus Aerokernel
Other
44 stars 60 forks source link

[BUG] APIC pointer dereference after boot_kmem_cleanup #50

Open btauro opened 3 years ago

btauro commented 3 years ago

We've encountered a GPF when Nautilus is compiled with -O 0 both in gcc and clang in qemu and baremetal.

Looks like mm_boot_kmem_cleanup() corrupts cpu struct (naut->sys.cpus)

Reproducibility qemu-system-x86_64 --enable-kvm -smp 4 -m 4G -cdrom nautilus.iso -vga vmware -serial mon:stdio gcc version 10.2.1 Linux Kernel 5.8.14-200.fc32.x86_64 (Fedora 32)

+++ UNHANDLED EXCEPTION +++
[General Protection Fault] (0xd) error=0x0 <#GP>
    RIP=0x0043a113      (core=4294967295, thread=4294967295)
Current Thread=0x1 (0x02406000) ""
[-------------- Register Contents --------------]
RIP: 0008:000000000043a113
RSP: 0010:00000000bf3ff840 RFLAGS: 00010002 Vector: 0000000d Error: 00000000
RAX: f000f84dc0005624 RBX: 0000000000000000 RCX: 000000000286ec80
RDX: 0000000000000000 RDI: f000f84dc0005624 RSI: 0000000000000030
RBP: 00000000bf3ff860 R08: 00000000bf3ff880 R09: 00000000bf3ff880
R10: 00000000bf3ff880 R11: 00000000bf3ff880 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0010) GS: 0000000000802000(0000) knlGS: 0000000000000000
CS: 0008 DS: 0010 ES: 0010 CR0: 0000000080000033
CR2: 0000000000000000 CR3: 0000000000803000 CR4: 0000000000000620
CR8: 0000000000000000 EFER: 0000000000000500
[-----------------------------------------------]
[----------------- Call Trace ------------------]
[ 0] RIP: 0x0043a231 RBP: 0xbf3ff880
Symbol: apic_get_maxlvt   Section: .text
[ 1] RIP: 0x00346b7c RBP: 0xbf3ffbe0
Symbol: smp_bringup_aps   Section: .text
[ 2] RIP: 0x00429ab0 RBP: 0xbf3ffbf0
Symbol: init   Section: .text
[ 3] RIP: 0x00000000 RBP: 0x00000000
Symbol: ???   Section: .debug_loc
PANIC at src/nautilus/idt.c(132): +++ HALTING +++