linux-kernel - Re: Crash in intel_iommu_assign

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 02 Nov 2010 08:07:04 +0100
From:	Jan Kiszka <jan.kiszka@....de>
To:	Sheng Yang <sheng@...ux.intel.com>
CC:	kvm <kvm@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: Crash in intel_iommu_assign_device

Am 02.11.2010 07:52, Sheng Yang wrote:
> On Monday 01 November 2010 19:41:21 Jan Kiszka wrote:
>> Hi Sheng,
>>
>> I'm not claiming to understand the details, but this looks like use
>> (dereference of pte via dma_pte_addr) after release (free_pgtable_page
>> of dmar_domain->pgd aka pte) to me:
>>
>> static int intel_iommu_attach_device(struct iommu_domain *domain,
>> 				     struct device *dev)
>> {
>> 	[...]
>> 		pte = dmar_domain->pgd;
>> 		if (dma_pte_present(pte)) {
>> 			free_pgtable_page(dmar_domain->pgd);
>> 			dmar_domain->pgd = (struct dma_pte *)
>> 				phys_to_virt(dma_pte_addr(pte));
>> 		}
>>
>> At least it crashes here right on pte->val access. Swap both lines?
> 
> I think code is right.
> 
> The comment above indicate the case: the code want to decrease the level of page 
> table. Mostly it is a 4 level page table, and the code would turn it into 3 levels 
> pagetable. What the code did is just get the first entry of the old pagetable level 
> 4, then free the level 4 pagetable's page, and make the pagetable to a level 3 
> pagetable.
> 
> Seems it make no sense to swap the lines...

It fixes the crash here, and I'm convinced the current code is wrong.
See the patch I've just sent out.

Jan


Download attachment "signature.asc" of type "application/pgp-signature" (260 bytes)