linux-kernel - Re: [PATCH] BUG in pv_clock when overflow condition is detected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F3B8DC9.8040100@redhat.com>
Date:	Wed, 15 Feb 2012 12:49:45 +0200
From:	Avi Kivity <avi@...hat.com>
To:	Igor Mammedov <imammedo@...hat.com>
CC:	linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
	tglx@...utronix.de, mingo@...hat.com, hpa@...or.com,
	riel@...hat.com, amit.shah@...hat.com, mtosatti@...hat.com
Subject: Re: [PATCH] BUG in pv_clock when overflow condition is detected

On 02/13/2012 08:20 PM, Igor Mammedov wrote:
> BUG when overflow occurs at pvclock.c:pvclock_get_nsec_offset
>
>     u64 delta = native_read_tsc() - shadow->tsc_timestamp;
>
> this might happen at an attempt to read an uninitialized yet clock.
> It won't prevent stalls and hangs but at least it won't do it silently.
>
> Signed-off-by: Igor Mammedov <imammedo@...hat.com>
> ---
>  arch/x86/kernel/pvclock.c |    5 ++++-
>  1 files changed, 4 insertions(+), 1 deletions(-)
>
> diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
> index 42eb330..35a6190 100644
> --- a/arch/x86/kernel/pvclock.c
> +++ b/arch/x86/kernel/pvclock.c
> @@ -43,7 +43,10 @@ void pvclock_set_flags(u8 flags)
>  
>  static u64 pvclock_get_nsec_offset(struct pvclock_shadow_time *shadow)
>  {
> -	u64 delta = native_read_tsc() - shadow->tsc_timestamp;
> +	u64 delta;
> +	u64 tsc = native_read_tsc();
> +	BUG_ON(tsc < shadow->tsc_timestamp);
> +	delta = tsc - shadow->tsc_timestamp;
>  	return pvclock_scale_delta(delta, shadow->tsc_to_nsec_mul,
>  				   shadow->tsc_shift);

Maybe a WARN_ON_ONCE()?  Otherwise a relatively minor hypervisor bug can
kill the guest.

-- 
error compiling committee.c: too many arguments to function

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/