Messages in this thread | | | Date | Fri, 24 Jul 2015 08:37:10 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH v3 1/3] x86/ldt: Make modify_ldt synchronous |
| |
On Wed, Jul 22, 2015 at 12:23:46PM -0700, Andy Lutomirski wrote: > modify_ldt has questionable locking and does not synchronize > threads. Improve it: redesign the locking and synchronize all > threads' LDTs using an IPI on all modifications. > > This will dramatically slow down modify_ldt in multithreaded > programs, but there shouldn't be any multithreaded programs that > care about modify_ldt's performance in the first place. > > Cc: stable@vger.kernel.org > Signed-off-by: Andy Lutomirski <luto@kernel.org>
...
> +struct ldt_struct { > + /* > + * Xen requires page-aligned LDTs with special permissions. This is > + * needed to prevent us from installing evil descriptors such as > + * call gates. On native, we could merge the ldt_struct and LDT > + * allocations, but it's not worth trying to optimize.
I don't think baremetal should care about xen and frankly, this is getting ridiculous, slowly - baremetal has to wait with a potentially critical security fix just because it breaks xen. Dammit, this level of intrusiveness into x86 should've never been allowed.
-- Regards/Gruss, Boris.
ECO tip #101: Trim your mails when you reply. --
| |