On Wed, Nov 29, 2017 at 11:38:22AM -0500, Serhii Popovych wrote: > It is possible to trigger use after free during HPT resize > causing host kernel to crash. More details and analysis of > the problem can be found in change with corresponding subject > (KVM: PPC: Book3S HV: Fix use after free in case of multiple > resize requests). > > We need some changes to prepare for the fix, especially > make ->error in HPT resize instance single point for > tracking allocation state, improve kvmppc_allocate_hpt() > and kvmppc_free_hpt() so they can be used more safely. > > See individual commit description message to get more > information on changes presented. > > Serhii Popovych (4): > KVM: PPC: Book3S HV: Drop prepare_done from struct kvm_resize_hpt and > cleanups > KVM: PPC: Book3S HV: Improve kvmppc_allocate_hpt()/kvmppc_free_hpt() > KVM: PPC: Book3S HV: Fix use after free in case of multiple resize > requests > KVM: PPC: Book3S HV: Remove redundant parameter from > resize_hpt_release() > > arch/powerpc/kvm/book3s_64_mmu_hv.c | 139 +++++++++++++++++++++--------------- > 1 file changed, 82 insertions(+), 57 deletions(-) Paul, these (at least 1-3) fix (another :() host crash bug which can be triggered by guest and/or userspace actions. Please merge ASAP. -- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson
Attachment:
signature.asc
Description: PGP signature
