linux-kernel - Re: [PATCH] Xen: ARM: Zero reserved fields of xatp before making hypervisor call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 20 Dec 2016 11:31:07 +0100
From:   Julien Grall <julien.grall@....com>
To:     Jiandi An <anjiandi@...eaurora.org>,
        Stefano Stabellini <sstabellini@...nel.org>
Cc:     Juergen Gross <jgross@...e.com>, boris.ostrovsky@...cle.com,
        xen-devel@...ts.xenproject.org, linux-kernel@...r.kernel.org,
        shankerd@...eaurora.org, shannon.zhao@...aro.org
Subject: Re: [PATCH] Xen: ARM: Zero reserved fields of xatp before making
 hypervisor call

Hi Jiandi,

Please respect the netiquette and wrap line to 70-75 characters.

On 20/12/2016 06:02, Jiandi An wrote:
> On 12/19/16 12:49, Stefano Stabellini wrote:
>> On Mon, 19 Dec 2016, Juergen Gross wrote:
>>> On 19/12/16 03:56, Jiandi An wrote:

> Thanks for you comments.  xatp is passed to XEN via the hypervisor call in each loop.
> XEN touches xatp and returns it back.  For example XEN returns error of underlying mapping call in the err[] array in xatp. (The err[] is not checked after the hypervisor call returns and it's a bug to be addressed in a separate patch)  XEN could theoretically corrupt xatp when it's returned.  And the loop would go on to the next iteration passing in whatever that's in xatp returned by the previous hypervisor call.  Harder to debug in my opinion if xatp get corrupted by XEN somehow when a bug is introduced in XEN.  At first I put the memset of xatp at the beginning outside of the loop.  But I thought it's better to initialize xatp that's passed in each time a hypervisor call is made so we know exactly we set going into the hypervisor call.

If you move struct xen_add_to_physmap_range in the loop, the compiler 
will initialize and zeroed for you the structure at each loop. I.e

for (i = 0; i < count; i++) {
	struct xen_add_to_physmap_range xapt = ....


}

Cheers,

-- 
Julien Grall