Bug 221239 - Use of domain_crash_synchronous in illegal contexts
Use of domain_crash_synchronous in illegal contexts
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel-xen (Show other bugs)
5.0
All Linux
medium Severity high
: ---
: ---
Assigned To: Herbert Xu
impact=important,source=redhat,report...
: Security
Depends On:
Blocks: 222058
  Show dependency treegraph
 
Reported: 2007-01-03 01:07 EST by Herbert Xu
Modified: 2007-11-30 17:07 EST (History)
3 users (show)

See Also:
Fixed In Version: 5.0.0
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-01-26 16:30:52 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
[XEN] Get rid of many uses of domain_crash_synchronous(). (33.53 KB, patch)
2007-01-03 01:07 EST, Herbert Xu
no flags Details | Diff
Replace inappropriate calls to domain_crash_synchronous (9.24 KB, patch)
2007-01-11 06:33 EST, Herbert Xu
no flags Details | Diff

  None (edit)
Description Herbert Xu 2007-01-03 01:07:49 EST
Using domain_crash_synchronous with IRQs disabled or spin locks held (or other
contexts where clean-up is required) can render the hypervisor inoperative. 
This patch from upstream fixes the offenders.
Comment 1 Herbert Xu 2007-01-03 01:07:49 EST
Created attachment 144684 [details]
[XEN] Get rid of many uses of domain_crash_synchronous().
Comment 2 Rik van Riel 2007-01-03 01:56:01 EST
Justification: security bug, HVM guests could shut down the host by performing
illegal operations.

The patch has already been posted to virtualist@ and rhkernel-list@.

Don, please apply the patch once it has received the ACKs required.
Comment 4 Jay Turner 2007-01-03 15:09:25 EST
QE ack for RHEL5.
Comment 5 Rik van Riel 2007-01-10 12:42:32 EST
While trying to reproduce bug 222058 here, I unwittingly kept reproducing this
bug instead.  Highly annoying to have the host crash 3 times in a row :)
Comment 6 Brian Stein 2007-01-10 14:34:28 EST
Herbert - 

Please quantify the security implications here for not having this in RC.
Comment 7 Herbert Xu 2007-01-10 15:40:33 EST
Rik, do you have a crash dump for this?

Brian, I've done an audit of all the domain_crash_synchronous() calls in RHEL5.
 As a result we only need a subset of this patch.  However, there are a number
of other similar patches which we need to pull instead.

I'll post them today.
Comment 9 Herbert Xu 2007-01-11 06:33:09 EST
Created attachment 145332 [details]
Replace inappropriate calls to domain_crash_synchronous
Comment 10 Jay Turner 2007-01-12 07:53:18 EST
QE ack for RHEL5.
Comment 11 Don Zickus 2007-01-12 15:17:38 EST
in 2.6.18-1.3014.el5
Comment 12 Jay Turner 2007-01-26 16:30:52 EST
2.6.9-7.el5 included in 20070125.0.

Note You need to log in before you can comment on or make changes to this bug.