From: butt3rflyh4ck <butterflyhuangxx@gmail.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Woodhouse, David" <dwmw@amazon.co.uk>,
kvm@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>
Subject: Re: There is a null-ptr-deref bug in kvm_dirty_ring_get in virt/kvm/dirty_ring.c
Date: Thu, 28 Oct 2021 15:42:10 +0800 [thread overview]
Message-ID: <CAFcO6XO7YMxHN+TwZvr3fxFypTt_nE3xLdvuBKPF_j0-ApsiFg@mail.gmail.com> (raw)
In-Reply-To: <9eb83cdd-9314-0d1f-0d4b-0cf4432e1e84@redhat.com>
I agree with you. But I don’t have a good idea how to fix it
Regards,
butt3rflyh4ck.
On Fri, Oct 22, 2021 at 4:08 AM Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> On 18/10/21 19:14, butt3rflyh4ck wrote:
> > {
> > struct kvm_vcpu *vcpu = kvm_get_running_vcpu(); //-------> invoke
> > kvm_get_running_vcpu() to get a vcpu.
> >
> > WARN_ON_ONCE(vcpu->kvm != kvm); [1]
> >
> > return &vcpu->dirty_ring;
> > }
> > ```
> > but we had not called KVM_CREATE_VCPU ioctl to create a kvm_vcpu so
> > vcpu is NULL.
>
> It's not just because there was no call to KVM_CREATE_VCPU; in general
> kvm->dirty_ring_size only works if all writes are associated to a
> specific vCPU, which is not the case for the one of
> kvm_xen_shared_info_init.
>
> David, what do you think? Making dirty-page ring buffer incompatible
> with Xen is ugly and I'd rather avoid it; taking the mutex for vcpu 0 is
> not an option because, as the reporter said, you might not have even
> created a vCPU yet when you call KVM_XEN_HVM_SET_ATTR. The remaining
> option would be just "do not mark the page as dirty if the ring buffer
> is active". This is feasible because userspace itself has passed the
> shared info gfn; but again, it's ugly...
>
> Paolo
>
--
Active Defense Lab of Venustech
next prev parent reply other threads:[~2021-10-28 7:42 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-18 17:14 There is a null-ptr-deref bug in kvm_dirty_ring_get in virt/kvm/dirty_ring.c butt3rflyh4ck
2021-10-21 20:08 ` Paolo Bonzini
2021-10-28 7:42 ` butt3rflyh4ck [this message]
2021-11-08 5:11 ` butt3rflyh4ck
2021-11-16 15:41 ` butt3rflyh4ck
2021-11-16 16:22 ` [EXTERNAL] " David Woodhouse
2021-11-16 17:07 ` David Woodhouse
2021-11-17 9:46 ` Woodhouse, David
2021-11-17 16:49 ` Paolo Bonzini
2021-11-17 18:10 ` Woodhouse, David
2021-11-20 10:16 ` KVM: Warn if mark_page_dirty() is called without an active vCPU David Woodhouse
2021-11-22 17:01 ` Sean Christopherson
2021-11-22 17:52 ` David Woodhouse
2021-11-22 18:49 ` Sean Christopherson
2022-01-13 12:06 ` Christian Borntraeger
2022-01-13 12:14 ` Paolo Bonzini
2022-01-13 12:29 ` [PATCH] KVM: avoid warning on s390 in mark_page_dirty Christian Borntraeger
2022-01-13 12:31 ` David Woodhouse
2022-01-18 8:37 ` Christian Borntraeger
2022-01-18 8:44 ` Paolo Bonzini
2022-01-18 8:53 ` Christian Borntraeger
2022-01-18 11:44 ` Paolo Bonzini
2022-01-13 12:30 ` KVM: Warn if mark_page_dirty() is called without an active vCPU David Woodhouse
2022-01-13 12:51 ` Christian Borntraeger
2022-01-13 13:22 ` David Woodhouse
2022-01-13 15:09 ` Christian Borntraeger
2022-01-13 14:36 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFcO6XO7YMxHN+TwZvr3fxFypTt_nE3xLdvuBKPF_j0-ApsiFg@mail.gmail.com \
--to=butterflyhuangxx@gmail.com \
--cc=dwmw@amazon.co.uk \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).