Messages in this thread | | | From | Juergen Gross <> | Subject | Access to non-RAM pages | Date | Wed, 29 Aug 2018 14:10:53 +0200 |
| |
Running as a Xen guest a customer's system experienced problems due to load_unaligned_zeropad() hitting a ballooned memory page. The 8 byte read was meant to read the last 4 bytes from a kernel page and should have returned 4 zero bytes for the not allocated page after that.
In order not to split huge direct map pages The Xen balloon driver doesn't remove ballooned pages from the direct map. The memory page is removed from the EPT, of course, but a bug in the hypervisor would emulate the 8 byte read wrong by returning all bytes as 0xff, leading to above mentioned problems.
While this bug can be repaired in Xen I'm rather sure it is dangerous to rely on load_unaligned_zeropad() doing the right thing when crossing page boundaries. Trying to access an invalid page is handled fine, but what happens if the next page is a MMIO area? Reading from that might have strange side effects.
While being very unlikely I still believe this is possible. Any thoughts?
Michal asked me to bring this up for a wider audience.
Juergen
| |