Re: kvm ptrace 32bit DoS bug - bisected

[Jan Kiszka <jan.kiszka@web.de>]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

Marcelo Tosatti wrote:
> On Sun, Sep 06, 2009 at 02:50:00PM +0700, Antoine Martin wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> [snip]
>>>> Is this an AMD host? 
>>> Nope, Intel Core2, more host info :
>> I have put all the relevant binaries and their config files here:
>> http://uml.devloop.org.uk/kvmbug/
>> Host kernel, qemu binary, kvm guest kernel and the UML binary I have
>> used for bisecting.
> 
> Antoine,
> 
> Works for me with master branch. Its likely this commit fixed it:
> 
> commit 76d4622776d007de3f90f311591babc5f6ba6f39
> Author: Avi Kivity <avi@redhat.com>
> Date:   Tue Sep 1 12:03:25 2009 +0300
> 
>     KVM: VMX: Check cpl before emulating debug register access
>     
>     Debug registers may only be accessed from cpl 0.  Unfortunately, vmx will
>     code to emulate the instruction even though it was issued from guest
>     userspace, possibly leading to an unexpected trap later.
> 
> It will be included in 2.6.30 / 2.6.27 stable (.29 is not maintained
> anymore).

Easy to check: Does the UML image still contain mov-to-db instructions?
If not, this commit cannot make the difference.

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 257 bytes --]