Red Hat Bugzilla – Bug 308811
CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels
Last modified: 2008-01-17 10:38:26 EST
The eHCA driver has a problem with mapping userspace resources. It's nicely
explained in the upstream git submission:
Some drivers have resources that they want to be able to map into
userspace that are 4k in size. On a kernel configured with 64k pages
we currently end up mapping the 4k we want plus another 60k of
physical address space, which could contain anything. This can
introduce security problems, for example in the case of an infiniband
adaptor where the other 60k could contain registers that some other
program is using for its communications.
galaxy has a 4k page of control registers for each single QP and CQ.
The physical adress of this page is defined by phyp when you allocate a resource.
To be able to send and receive data from userspace without a kernel call you
have to get access to that 4k page from userspace.
If the linux kernel only allows to map 64k pages into userspace there's a
conflict. Phyp only allows to map this page area in 4k chunks (H_ENTER).
* a flaw in the eHCA driver on PowerPC architectures that allowed a local
user to access 60k of physical address space.
This issue was addressed in:
Red Hat Enterprise Linux: