linux-kernel - Re: [PATCH v10 01/19] KVM: s390: pv: leak the topmost page table when destroy fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 16 May 2022 09:22:09 +0200
From:   Nico Boehr <nrb@...ux.ibm.com>
To:     Claudio Imbrenda <imbrenda@...ux.ibm.com>, kvm@...r.kernel.org
Cc:     borntraeger@...ibm.com, frankja@...ux.ibm.com, thuth@...hat.com,
        pasic@...ux.ibm.com, david@...hat.com, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, scgl@...ux.ibm.com,
        mimu@...ux.ibm.com
Subject: Re: [PATCH v10 01/19] KVM: s390: pv: leak the topmost page table
 when destroy fails

On Thu, 2022-04-14 at 10:02 +0200, Claudio Imbrenda wrote:

[...]
> +/**
> + * s390_replace_asce - Try to replace the current ASCE of a gmap
> with
> + * another equivalent one.
> + * @gmap the gmap
> + *
> + * If the allocation of the new top level page table fails, the ASCE
> is not
> + * replaced.
> + * In any case, the old ASCE is always removed from the list.
> Therefore the
> + * caller has to make sure to save a pointer to it beforehands,
> unless an
> + * intentional leak is intended.
> + */
> +int s390_replace_asce(struct gmap *gmap)
> +{
> 
[...]
> +       /* Set new table origin while preserving existing ASCE
> control bits */
> +       asce = (gmap->asce & ~_ASCE_ORIGIN) | __pa(table);
> +       WRITE_ONCE(gmap->asce, asce);

Can someone concurrently touch the control bits?