lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 16 Jan 2011 17:17:51 +0200 From: Avi Kivity <avi@...hat.com> To: Rik van Riel <riel@...hat.com> CC: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, Srivatsa Vaddagiri <vatsa@...ux.vnet.ibm.com>, Peter Zijlstra <a.p.zijlstra@...llo.nl>, Mike Galbraith <efault@....de>, Chris Wright <chrisw@...s-sol.org>, ttracy@...hat.com, dshaks@...hat.com Subject: Re: [RFC -v5 PATCH 1/4] kvm: keep track of which task is running a KVM vcpu On 01/14/2011 10:03 AM, Rik van Riel wrote: > Keep track of which task is running a KVM vcpu. This helps us > figure out later what task to wake up if we want to boost a > vcpu that got preempted. > > Unfortunately there are no guarantees that the same task > always keeps the same vcpu, so we can only track the task > across a single "run" of the vcpu. > > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 5225052..65e997a 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -185,6 +185,7 @@ int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id) > vcpu->cpu = -1; > vcpu->kvm = kvm; > vcpu->vcpu_id = id; > + vcpu->pid = 0; NULL > @@ -1456,6 +1459,12 @@ static long kvm_vcpu_ioctl(struct file *filp, > r = -EINVAL; > if (arg) > goto out; > + if (unlikely(vcpu->pid != current->pids[PIDTYPE_PID].pid)) { > + /* The thread running this VCPU changed. */ > + struct pid *oldpid = vcpu->pid; > + vcpu->pid = get_task_pid(current, PIDTYPE_PID); > + put_pid(oldpid); > + } This is subject to the same race as before. If another vcpu picks up vcpu->pid before the assignment (that is, oldpid), but dereferences it after put_pid(), it hits freed memory. You want something like struct pid *oldpid = vcpu->pid; rcu_assign_pointer(vcpu->pid, get_task_pid()); synchronize_rcu(); put_pid(oldpid); with rcu_read_lock() / rcu_dereference() protection on the reader side. -- error compiling committee.c: too many arguments to function -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists