linux-kernel - Re: [GIT PULL] Btrfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20131118103055.GA22763@mudshark.cambridge.arm.com>
Date:	Mon, 18 Nov 2013 10:30:55 +0000
From:	Will Deacon <will.deacon@....com>
To:	Heiko Carstens <heiko.carstens@...ibm.com>
Cc:	Gleb Natapov <gleb@...hat.com>,
	Geert Uytterhoeven <geert@...ux-m68k.org>,
	Chris Mason <chris.mason@...ionio.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	linux-btrfs <linux-btrfs@...r.kernel.org>,
	lkml <linux-kernel@...r.kernel.org>,
	Dulshani Gunawardhana <dulshani.gunawardhana89@...il.com>,
	Paolo Bonzini <pbonzini@...hat.com>,
	Mark Brown <broonie@...nel.org>,
	Catalin Marinas <Catalin.Marinas@....com>
Subject: Re: [GIT PULL] Btrfs

On Mon, Nov 18, 2013 at 09:35:55AM +0000, Heiko Carstens wrote:
> From b19687bad7e878aaed6edb786a22c6b05e886b97 Mon Sep 17 00:00:00 2001
> From: Heiko Carstens <heiko.carstens@...ibm.com>
> Date: Mon, 18 Nov 2013 10:05:57 +0100
> Subject: [PATCH] kvm: kvm_clear_guest_page(): fix empty_zero_page usage
> 
> Using the address of 'empty_zero_page' as source address in order to clear
> a page is wrong. On some architectures empty_zero_page is only the pointer
> to the struct page of the empty_zero_page.
> Therefore the clear page operation would copy the contents of a couple of
> struct pages instead of clearing a page.
> For kvm only arm64 is affected by this bug.

In theory ARM is affected too, but this code doesn't seem to be invoked by
any architecture other than x86 afaict. It looks like there's a similar
issue in drivers/spi/spi-fsl-cpm.c where empty_zero_page is used as a dummy
dma buffer, but that code is basically powerpc only, so again, unlikely to
cause a problem in practice.

Will

> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 662f34c3287e..a0aa84b5941a 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -1615,8 +1615,9 @@ EXPORT_SYMBOL_GPL(kvm_read_guest_cached);
>  
>  int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len)
>  {
> -	return kvm_write_guest_page(kvm, gfn, (const void *) empty_zero_page,
> -				    offset, len);
> +	const void *zero_page = (const void *) __va(page_to_phys(ZERO_PAGE(0)));
> +
> +	return kvm_write_guest_page(kvm, gfn, zero_page, offset, len);
>  }
>  EXPORT_SYMBOL_GPL(kvm_clear_guest_page);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/