From: Michael Ellerman <michael@ellerman•id.au>
To: David Gibson <david@gibson•dropbear.id.au>,
Serhii Popovych <spopovyc@redhat•com>
Cc: linux-kernel@vger•kernel.org, paulus@samba•org,
linuxppc-dev@lists•ozlabs.org, kvm-ppc@vger•kernel.org
Subject: Re: [PATCH 0/4] Fix use after free in HPT resizing code and related minor improvements
Date: Mon, 04 Dec 2017 23:22:47 +1100 [thread overview]
Message-ID: <87indmsmw8.fsf@concordia.ellerman.id.au> (raw)
In-Reply-To: <20171204061025.GQ2130@umbus.fritz.box>
David Gibson <david@gibson•dropbear.id.au> writes:
> On Wed, Nov 29, 2017 at 11:38:22AM -0500, Serhii Popovych wrote:
>> It is possible to trigger use after free during HPT resize
>> causing host kernel to crash. More details and analysis of
>> the problem can be found in change with corresponding subject
>> (KVM: PPC: Book3S HV: Fix use after free in case of multiple
>> resize requests).
>>
>> We need some changes to prepare for the fix, especially
>> make ->error in HPT resize instance single point for
>> tracking allocation state, improve kvmppc_allocate_hpt()
>> and kvmppc_free_hpt() so they can be used more safely.
>>
>> See individual commit description message to get more
>> information on changes presented.
>
> I spoke with Paul Mackerras about these patches on IRC today. We want
> this as a fix, ASAP, in 4.15. However, he's uncomfortable with
> pushing some of extra cleanups which aren't necessary for the bug fix
> this late for 4.15, and was having trouble following what was the core
> of the fix. He was also nervous about the addition of more BUG_ON()s.
As was I.
> To avoid the round trip to Ukraine time and back, I've made revised
> versions of patches 1 & 3 which should apply standalone, replaced the
> BUG_ON()s with WARN_ON()s
Thanks.
cheers
next prev parent reply other threads:[~2017-12-04 12:22 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-29 16:38 [PATCH 0/4] Fix use after free in HPT resizing code and related minor improvements Serhii Popovych
2017-11-29 16:38 ` [PATCH 1/4] KVM: PPC: Book3S HV: Drop prepare_done from struct kvm_resize_hpt and cleanups Serhii Popovych
2017-11-30 3:40 ` David Gibson
2017-11-29 16:38 ` [PATCH 2/4] KVM: PPC: Book3S HV: Improve kvmppc_allocate_hpt()/kvmppc_free_hpt() Serhii Popovych
2017-11-30 3:45 ` David Gibson
2017-11-29 16:38 ` [PATCH 3/4] KVM: PPC: Book3S HV: Fix use after free in case of multiple resize requests Serhii Popovych
2017-11-30 3:51 ` David Gibson
2017-11-29 16:38 ` [PATCH 4/4] KVM: PPC: Book3S HV: Remove redundant parameter from resize_hpt_release() Serhii Popovych
2017-11-30 3:53 ` David Gibson
2017-11-30 3:54 ` [PATCH 0/4] Fix use after free in HPT resizing code and related minor improvements David Gibson
2017-12-04 6:10 ` David Gibson
2017-12-04 12:22 ` Michael Ellerman [this message]
2017-12-04 14:43 ` Serhii Popovych
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87indmsmw8.fsf@concordia.ellerman.id.au \
--to=michael@ellerman$(echo .)id.au \
--cc=david@gibson$(echo .)dropbear.id.au \
--cc=kvm-ppc@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linuxppc-dev@lists$(echo .)ozlabs.org \
--cc=paulus@samba$(echo .)org \
--cc=spopovyc@redhat$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox