Re: kvm ptrace 32bit DoS bug - bisected

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Jan Kiszka wrote:
> Marcelo Tosatti wrote:
>> On Sun, Sep 06, 2009 at 02:50:00PM +0700, Antoine Martin wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA512
>>>
>>> [snip]
>>>>> Is this an AMD host? 
>>>> Nope, Intel Core2, more host info :
>>> I have put all the relevant binaries and their config files here:
>>> http://uml.devloop.org.uk/kvmbug/
>>> Host kernel, qemu binary, kvm guest kernel and the UML binary I have
>>> used for bisecting.
>> Antoine,
>>
>> Works for me with master branch. Its likely this commit fixed it:
>>
>> commit 76d4622776d007de3f90f311591babc5f6ba6f39
>> Author: Avi Kivity <avi@xxxxxxxxxx>
>> Date:   Tue Sep 1 12:03:25 2009 +0300
>>
>>     KVM: VMX: Check cpl before emulating debug register access
>>     
>>     Debug registers may only be accessed from cpl 0.  Unfortunately, vmx will
>>     code to emulate the instruction even though it was issued from guest
>>     userspace, possibly leading to an unexpected trap later.
>>
>> It will be included in 2.6.30 / 2.6.27 stable (.29 is not maintained
>> anymore).
> 
> Easy to check: Does the UML image still contain mov-to-db instructions?
> If not, this commit cannot make the difference.
I'd be happy to grep it if you give me the mov-to-db opcode.

Anyway, I am happy to report that upgrading the host to 2.6.31 prevents
the guests from crashing.

Antoine
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux