In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mshv: Order pt_vp_array publish against irqfd assertion path<\/p>\n
mshv_partition_ioctl_create_vp() initialises a VP struct (allocations,
\nmutex_init, init_waitqueue_head, page mappings) and then publishes the
\npointer into partition->pt_vp_array. Several ISR paths read this array
\nlocklessly: the intercept ISR, the two scheduler ISRs, and
\nmshv_try_assert_irq_fast() on the irqfd fast path.<\/p>\n
Of these, only mshv_try_assert_irq_fast() can structurally race the
\npublish. It runs from an eventfd waker without holding pt_mutex, and
\nMSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to
\nrefer to an existing VP at registration time. A user can therefore
\nregister an irqfd targeting a yet-to-be-created VP, then trigger
\nmshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the
\nsame index. On weakly-ordered architectures the reader can observe a
\nnon-NULL pointer in pt_vp_array before the initialising stores to the
\nVP struct become visible, leading to use of partially-initialised
\nfields (e.g. vp_register_page).<\/p>\n
The other ISR readers cannot reach this race: the hypervisor will not
\ngenerate intercept or scheduler messages for a VP that has never been
\ntold to run, and the user can only call MSHV_RUN_VP on the VP fd
\nreturned by MSHV_CREATE_VP, which by construction is returned after
\nthe publish. Leave those readers as plain loads.<\/p>\n
Use smp_store_release() in mshv_partition_ioctl_create_vp() to publish
\nthe pointer, and pair it with smp_load_acquire() in
\nmshv_try_assert_irq_fast(). On x86 these compile to plain accesses
\nunder TSO; on ARM64 they emit one-instruction acquire\/release barriers,
\nacceptable on this fast path.<\/p>\n
The destroy-side path (destroy_partition() clearing pt_vp_array[i] to
\nNULL after kfree(vp)) has a separate ordering and lifetime concern
\nthat is out of scope here.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mshv: Order pt_vp_array publish against irqfd assertion path<\/p>\n
mshv_partition_ioctl_create_vp() initialises a VP struct (allocations<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17475","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}