Access to non-RAM pages

[Juergen Gross]

Running as a Xen guest a customer's system experienced problems due
to load_unaligned_zeropad() hitting a ballooned memory page. The
8 byte read was meant to read the last 4 bytes from a kernel page
and should have returned 4 zero bytes for the not allocated page
after that.

In order not to split huge direct map pages The Xen balloon driver
doesn't remove ballooned pages from the direct map. The memory page
is removed from the EPT, of course, but a bug in the hypervisor would
emulate the 8 byte read wrong by returning all bytes as 0xff, leading
to above mentioned problems.

While this bug can be repaired in Xen I'm rather sure it is dangerous
to rely on load_unaligned_zeropad() doing the right thing when crossing
page boundaries. Trying to access an invalid page is handled fine, but
what happens if the next page is a MMIO area? Reading from that might
have strange side effects.

While being very unlikely I still believe this is possible. Any
thoughts?

Michal asked me to bring this up for a wider audience.


Juergen