Re: [PATCH] x86/hvm: Fix use-after-free introduced by c/s 428607a

[Corneliu ZUZU <czuzu@bitdefender.com>]

On 2/2/2016 12:52 PM, Jan Beulich wrote:
>> NULLing the pointers would cause things like rtc_deinit() to always blow
>> up when it followed the NULL pointer.
>>
>> IMO, we should unconditionally always NULL pointers when freeing a
>> pointer which isn't in local scope.  It would make issues such as these
>> completely obvious.
> As would poisoning the pointers, yet poisoning has the advantage
> of not allowing PV guests to control what the hypervisor might
> access when erroneously de-referencing such a pointer.
>
> Jan

Jan, that sounds interesting. I hope I'm not intruding, but when you 
have the time, could you please expand on this?
Besides distinguishing a nuked pointer from zeroed-out memory, I did not 
know of any other advantage of 0xDEADBEEF pointer poisoning (generally 
or specifically).
How could possibly setting a pointer to NULL allow a PV guest to control 
what the hypervisor might access, if the hypervisor *can't access* a 
NULL pointer?
And can a PV guest write data @ *hypervisor's* 0 page  (virtual and/or 
physical)?

Corneliu.