linux-kernel - Re: [PATCH v2] vmw_balloon: fixing double free when batching mode is off

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <E63288C3-BE4F-4D41-A074-1CB86C74414E@vmware.com>
Date:   Wed, 14 Mar 2018 04:02:31 +0000
From:   Nadav Amit <namit@...are.com>
To:     Arnd Bergmann <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Oleksandr Natalenko <onatalen@...hat.com>
CC:     Xavier Deguillard <xdeguillard@...are.com>,
        pv-drivers <pv-drivers@...are.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Gil Kupfer <gilkup@...il.com>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: Re: [PATCH v2] vmw_balloon: fixing double free when batching mode is
 off

Nadav Amit <namit@...are.com> wrote:

> From: Gil Kupfer <gilkup@...il.com>
> 
> The balloon.page field is used for two different purposes if batching is
> on or off. If batching is on, the field point to the page which is used
> to communicate with with the hypervisor. If it is off, balloon.page
> points to the page that is about to be (un)locked.
> 
> Unfortunately, this dual-purpose of the field introduced a bug: when the
> balloon is popped (e.g., when the machine is reset or the balloon driver
> is explicitly removed), the balloon driver frees, unconditionally, the
> page that is held in balloon.page.  As a result, if batching is
> disabled, this leads to double freeing the last page that is sent to the
> hypervisor.

Oleksandr, if you can confirm that it fixes the bug you encountered, it
would be great.

Greg, Arnd, on your free time, please let me know if there is any issue
with the patch, and whether you can incorporate it, preferably in 4.16,
since it is a bug-fix that was encountered by Red-Hat customers.

Thanks,
Nadav