Re: [Xen-ia64-devel] [PATCH][TAKE3] Fix vulnerability of copy_to_user in PAL emulation

[tgingold@xxxxxxx]

Quoting Kouya Shimura <kouya@xxxxxxxxxxxxxx>:

> Hi,
>
> The reputation of my previous patch was not so good,
> then I rewrote it. An attached patch is temporary fix
> for xen-3.2.
>
> I think this patch is enough for normal usage.
> Please see SDM Vol2 11.10.2.1.3 "Making PAL Procedure
> Calls in Physical or Virtual Mode".
> If the caller has a responsibility of providing DTR or DTC
> mapping, xencomm for PAL might be unnecessary.

Right, that's a very interesting way.  It also implies the buffer can't
spread across two pages.

> I confirmed there is no problem in linux, windows 2003,
> windows 2008 with this patch.

Good!

> As for PV domain, the same logic can't be used due to
> only one vTLB. This patch only checks that the buffer
> never point VMM address, that would avoid the vulnerability.

Ok.

Tristan.

_______________________________________________
Xen-ia64-devel mailing list
Xen-ia64-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ia64-devel