linux-kernel - Access to non-RAM pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <3009b28a-971c-920a-9184-900f1f3b2203@suse.com>
Date:   Wed, 29 Aug 2018 14:10:53 +0200
From:   Juergen Gross <jgross@...e.com>
To:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Michal Hocko <mhocko@...e.com>
Subject: Access to non-RAM pages

Running as a Xen guest a customer's system experienced problems due
to load_unaligned_zeropad() hitting a ballooned memory page. The
8 byte read was meant to read the last 4 bytes from a kernel page
and should have returned 4 zero bytes for the not allocated page
after that.

In order not to split huge direct map pages The Xen balloon driver
doesn't remove ballooned pages from the direct map. The memory page
is removed from the EPT, of course, but a bug in the hypervisor would
emulate the 8 byte read wrong by returning all bytes as 0xff, leading
to above mentioned problems.

While this bug can be repaired in Xen I'm rather sure it is dangerous
to rely on load_unaligned_zeropad() doing the right thing when crossing
page boundaries. Trying to access an invalid page is handled fine, but
what happens if the next page is a MMIO area? Reading from that might
have strange side effects.

While being very unlikely I still believe this is possible. Any
thoughts?

Michal asked me to bring this up for a wider audience.

Juergen