From mboxrd@z Thu Jan 1 00:00:00 1970 From: Corneliu ZUZU Subject: Re: [PATCH] x86/hvm: Fix use-after-free introduced by c/s 428607a Date: Tue, 2 Feb 2016 14:51:11 +0200 Message-ID: <56B0A63F.7080301@bitdefender.com> References: <1454349419-18430-1-git-send-email-andrew.cooper3@citrix.com> <56B0964502000078000CD620@prv-mh.provo.novell.com> <56B08980.8060607@citrix.com> <56B0988F02000078000CD647@prv-mh.provo.novell.com> <56B0955D.2010002@bitdefender.com> <56B09B7F.8080307@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <56B09B7F.8080307@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Andrew Cooper , Jan Beulich Cc: Xen-devel List-Id: xen-devel@lists.xenproject.org On 2/2/2016 2:05 PM, Andrew Cooper wrote: > Xen and PV guests share the virtual address space, in exactly the same > way as a native kernel and its userspace. PV guests can map pages at > 0. Therefore, if Xen were to accidentally follow a NULL pointer, it > may not result in a pagefault. (Hardware mechanisms such as SMEP and > SMAP are added protection against this, but don't work on older hardware) > ~Andrew Thank you, I finally got it. (I also read http://wiki.xenproject.org/wiki/X86_Paravirtualised_Memory_Management , cleared things up) Corneliu.