[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH] x86/hvm: Fix use-after-free introduced by c/s 428607a


  • To: Jan Beulich <JBeulich@xxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
  • From: Corneliu ZUZU <czuzu@xxxxxxxxxxxxxxx>
  • Date: Tue, 2 Feb 2016 13:39:09 +0200
  • Cc: Xen-devel <xen-devel@xxxxxxxxxxxxx>
  • Comment: DomainKeys? See http://domainkeys.sourceforge.net/
  • Delivery-date: Tue, 02 Feb 2016 11:39:25 +0000
  • Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=bitdefender.com; b=g1Gg/cri5HreDZNIkWnePg8XFCeJfYgG1ejkvk8fnikMbPxGvbayeS0uGOQJkNu7AjmUwyNWhuA77otvclaQTieG9cQmASgWdDrmdA3uQrew07NpZNqTQKRGjEPviLy47RFG/Q8lNhnT2YklivU67e9eJrcjHXN9hLxKk1w11oYz4bo+uzu6BHFRXTeUohJ9Ksm0TTzIQobkVe5Wjccpow/gZoT1BfbLSnaJKFfNVBL40qa+iFwdkEyYCsS2tdxP9shpq9O0/b0ein9EJbD5JdnhTx8ZAnrf1o/YhQaZyvO2J/g/WmmEYvzemj25ZzzAder7FSWdRt0tIdfcb0jNBw==; h=Received:Received:Received:Received:Received:Subject:To:References:Cc:From:Message-ID:Date:User-Agent:MIME-Version:In-Reply-To:Content-Type:Content-Transfer-Encoding:X-BitDefender-Scanner:X-BitDefender-Spam:X-BitDefender-SpamStamp:X-BitDefender-CF-Stamp;
  • List-id: Xen developer discussion <xen-devel.lists.xen.org>

On 2/2/2016 12:52 PM, Jan Beulich wrote:
NULLing the pointers would cause things like rtc_deinit() to always blow
up when it followed the NULL pointer.

IMO, we should unconditionally always NULL pointers when freeing a
pointer which isn't in local scope.  It would make issues such as these
completely obvious.
As would poisoning the pointers, yet poisoning has the advantage
of not allowing PV guests to control what the hypervisor might
access when erroneously de-referencing such a pointer.

Jan

Jan, that sounds interesting. I hope I'm not intruding, but when you have the time, could you please expand on this? Besides distinguishing a nuked pointer from zeroed-out memory, I did not know of any other advantage of 0xDEADBEEF pointer poisoning (generally or specifically). How could possibly setting a pointer to NULL allow a PV guest to control what the hypervisor might access, if the hypervisor *can't access* a NULL pointer? And can a PV guest write data @ *hypervisor's* 0 page (virtual and/or physical)?

Corneliu.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.