linux-kernel - Re: [PATCH] espfix/xen: Fix allocation of pages for paravirt page tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140709181304.GA32419@laptop.dumpdata.com>
Date:	Wed, 9 Jul 2014 14:13:04 -0400
From:	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
To:	Boris Ostrovsky <boris.ostrovsky@...cle.com>
Cc:	hpa@...ux.intel.com, david.vrabel@...rix.com, linux@...elenboom.it,
	xen-devel@...ts.xenproject.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] espfix/xen: Fix allocation of pages for paravirt page
 tables

On Wed, Jul 09, 2014 at 01:18:18PM -0400, Boris Ostrovsky wrote:
> init_espfix_ap() is currently off by one level when informing hypervisor
> that allocated pages will be used for ministacks' page tables.
> 
> The most immediate effect of this on a PV guest is that if
> 'stack_page = __get_free_page()' returns a non-zeroed-out page the hypervisor
> will refuse to use it for a page table (which it shouldn't be anyway). This will
> result in warnings by both Xen and Linux.
> 
> More importantly, a subsequent write to that page (again, by a PV guest) is
> likely to result in fatal page fault.
> 
> Signed-off-by: Boris Ostrovsky <boris.ostrovsky@...cle.com>

Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>

<sigh>
> ---
>  arch/x86/kernel/espfix_64.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
> index 6afbb16..94d857f 100644
> --- a/arch/x86/kernel/espfix_64.c
> +++ b/arch/x86/kernel/espfix_64.c
> @@ -175,7 +175,7 @@ void init_espfix_ap(void)
>  	if (!pud_present(pud)) {
>  		pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
>  		pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
> -		paravirt_alloc_pud(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
> +		paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
>  		for (n = 0; n < ESPFIX_PUD_CLONES; n++)
>  			set_pud(&pud_p[n], pud);
>  	}
> @@ -185,7 +185,7 @@ void init_espfix_ap(void)
>  	if (!pmd_present(pmd)) {
>  		pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
>  		pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
> -		paravirt_alloc_pmd(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
> +		paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
>  		for (n = 0; n < ESPFIX_PMD_CLONES; n++)
>  			set_pmd(&pmd_p[n], pmd);
>  	}
> @@ -193,7 +193,6 @@ void init_espfix_ap(void)
>  	pte_p = pte_offset_kernel(&pmd, addr);
>  	stack_page = (void *)__get_free_page(GFP_KERNEL);
>  	pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
> -	paravirt_alloc_pte(&init_mm, __pa(stack_page) >> PAGE_SHIFT);
>  	for (n = 0; n < ESPFIX_PTE_CLONES; n++)
>  		set_pte(&pte_p[n*PTE_STRIDE], pte);
>  
> -- 
> 1.8.1.4
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/