| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 05 May 2007 01:00:31 +1000 From: Rusty Russell <rusty@...tcorp.com.au> To: Andrew Morton <akpm@...ux-foundation.org> Cc: lkml - Kernel Mailing List <linux-kernel@...r.kernel.org>, virtualization <virtualization@...ts.linux-foundation.org> Subject: [PATCH 3/3] lguest: fix obscure but nasty cow bug Nasty bug where the host is the first to write a MAP_PRIVATE page: the guest still references the old one and won't see the write. This can happen with just the wrong data layouts for the initial setup hypercall (the other places in the code are always written guest-first). Signed-off-by: Rusty Russell <rusty@...tcorp.com.au> --- drivers/lguest/hypercalls.c | 6 ++++++ 1 file changed, 6 insertions(+) =================================================================== --- a/drivers/lguest/hypercalls.c +++ b/drivers/lguest/hypercalls.c @@ -144,6 +144,12 @@ static void initialize(struct lguest *lg /* We reserve the top pgd entry. */ put_user(4U*1024*1024, &lg->lguest_data->reserve_mem); put_user(lg->guestid, &lg->lguest_data->guestid); + + /* This is the one case where the above accesses might have + * been the first write to a Guest page. This may have caused + * a copy-on-write fault, but the Guest might be referring to + * the old (read-only) page. */ + guest_pagetable_clear_all(lg); } /* Even if we go out to userspace and come back, we don't want to do - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists