Re: kvm ptrace 32bit DoS bug - bisected

[Antoine Martin <antoine@nagafix.co.uk>]

Jan Kiszka wrote:
> Marcelo Tosatti wrote:
>> On Sun, Sep 06, 2009 at 02:50:00PM +0700, Antoine Martin wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA512
>>>
>>> [snip]
>>>>> Is this an AMD host? 
>>>> Nope, Intel Core2, more host info :
>>> I have put all the relevant binaries and their config files here:
>>> http://uml.devloop.org.uk/kvmbug/
>>> Host kernel, qemu binary, kvm guest kernel and the UML binary I have
>>> used for bisecting.
>> Antoine,
>>
>> Works for me with master branch. Its likely this commit fixed it:
>>
>> commit 76d4622776d007de3f90f311591babc5f6ba6f39
>> Author: Avi Kivity <avi@redhat.com>
>> Date:   Tue Sep 1 12:03:25 2009 +0300
>>
>>     KVM: VMX: Check cpl before emulating debug register access
>>     
>>     Debug registers may only be accessed from cpl 0.  Unfortunately, vmx will
>>     code to emulate the instruction even though it was issued from guest
>>     userspace, possibly leading to an unexpected trap later.
>>
>> It will be included in 2.6.30 / 2.6.27 stable (.29 is not maintained
>> anymore).
> 
> Easy to check: Does the UML image still contain mov-to-db instructions?
> If not, this commit cannot make the difference.
I'd be happy to grep it if you give me the mov-to-db opcode.

Anyway, I am happy to report that upgrading the host to 2.6.31 prevents
the guests from crashing.

Antoine