[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH v2 3/3] [GSOC14] FIX:- Race condition between initializing shared ring and mempaging.

On 23/07/14 11:14, Ian Campbell wrote:
> On Mon, 2014-07-21 at 15:40 +0100, Andrew Cooper wrote:
>>> Note that the XSA commmit, 6ae2df93c27, does exactly that. Enable
>>> paging/access/sharing, and only after that decrease reservation (and
>>> after that unpause). So the window is open ... methinks?
>> No - it does a domain pause around this set of critical operations, so
>> the guest is guaranteed not to be running, and therefore cannot
>> interfere.
> Shouldn't there be a memset in here somewhere? To clear out any bogus
> material in the ring? (maybe the caller of this code always clears the
> ring itself, I didn't check that)
> Ian.

Erm.  There probably should be.  Xen sets up the ring frontend
correctly, but nothing I can spot cleans up any stale backend state
which was preexisting in the page.

It seems possible for a guest can map the affected pages and leave some
crafted backend replies which will be picked up as soon as mem_events
are enabled.  Combined with the lack of validation of responses in Xen,
this is quite bad.


Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.