lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5584485F.8050903@redhat.com>
Date:	Fri, 19 Jun 2015 18:50:39 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	"Michael S. Tsirkin" <mst@...hat.com>
CC:	Igor Mammedov <imammedo@...hat.com>, linux-kernel@...r.kernel.org,
	kvm@...r.kernel.org, andrey@...l.ru
Subject: Re: [PATCH 3/5] vhost: support upto 509 memory regions



On 19/06/2015 18:45, Michael S. Tsirkin wrote:
> >     user                      guest                 QEMU
> >     ----------------------------------------------------------------------------------------
> >                               start I/O
> >                                   '---------------> address_space_map
> >     device_del
> >         '-------------------> receives SCI
> >                               executes _EJ0
> >                                   '---------------> memory_region_del_subregion
> >                                                     object_unparent
> >     device_add
> >         '-----------------------------------------> device_set_realized
> >                                                       hotplug_handler_plug
> >                                                         pc_machine_device_plug_cb
> >                                                           pc_dimm_plug
> >                                                             memory_region_add_subregion
> > 
> >                                                     I/O finishes
> >                                                       address_space_unmap
> > 
> 
> OK so what's the problem with checking for this condition,
> after address_space_unmap detects that ref count is 0
> and before calling mmap(MAP_NORESERVE)?

Should be okay.  However, someone still needs to figure out the part
where device_add is delayed until the address_space_unmap.  Otherwise,
the device_add's mmap() overlays the older one and the delayed
mmap(MAP_NORESERVE) overlays the device_add's mmap().

It seems like a colossal waste of time to perfect a little-used path
that no doubt will have bugs in it, some of which could perhaps have
security consequences.

Also, QEMU is not the only vhost client, so we're just scratching the
surface here.

Paolo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ