From: Christoffer Dall <christoffer.dall@linaro.org>
To: kvmarm@lists.cs.columbia.edu
Cc: Kees Cook <keescook@chromium.org>,
kvm@vger.kernel.org, kernel-hardening@lists.openwall.com,
Marc Zyngier <marc.zyngier@arm.com>,
linux-arm-kernel@lists.infradead.org,
Paolo Bonzini <pbonzini@redhat.com>
Subject: [PATCH] KVM: arm/arm64: Allow usercopy to vcpu->arch.ctxt and arm64 debug
Date: Sat, 21 Oct 2017 20:45:45 +0200 [thread overview]
Message-ID: <20171021184545.2497-1-christoffer.dall@linaro.org> (raw)
In-Reply-To: <20171020232525.7387-1-pbonzini@redhat.com>
We do direct useraccess copying to the kvm_cpu_context structure
embedded in the kvm_vcpu_arch structure, and to the vcpu debug register
state. Everything else (timer, PMU, vgic) goes through a temporary
indirection.
Fixing all accesses to kvm_cpu_context is massively invasive, and we'd
like to avoid that, so we tell kvm_init_usercopy to whitelist accesses
to out context structure.
The debug system register accesses on arm64 are modified to work through
an indirection instead.
Cc: kernel-hardening@lists.openwall.com
Cc: Kees Cook <keescook@chromium.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
---
This fixes KVM/ARM on today's linux next with CONFIG_HARDENED_USERCOPY.
The patch is based on linux-next plus Paolo's x86 patch which introduces
kvm_init_usercopy. Not sure how this needs to get merged, but it would
potentially make sense for Paolo to put together a set of the patches
needed for this.
Thanks,
-Christoffer
arch/arm64/kvm/sys_regs.c | 36 ++++++++++++++++++++----------------
virt/kvm/arm/arm.c | 5 ++++-
2 files changed, 24 insertions(+), 17 deletions(-)
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 2e070d3baf9f..cdf47a9108fe 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -293,19 +293,20 @@ static bool trap_bvr(struct kvm_vcpu *vcpu,
static int set_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg] = r;
return 0;
}
static int get_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -335,10 +336,11 @@ static bool trap_bcr(struct kvm_vcpu *vcpu,
static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg] = r;
return 0;
}
@@ -346,9 +348,9 @@ static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
static int get_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -379,19 +381,20 @@ static bool trap_wvr(struct kvm_vcpu *vcpu,
static int set_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg] = r;
return 0;
}
static int get_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -421,19 +424,20 @@ static bool trap_wcr(struct kvm_vcpu *vcpu,
static int set_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg] = r;
return 0;
}
static int get_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index b9f68e4add71..639e388678ff 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -1502,7 +1502,10 @@ void kvm_arch_exit(void)
static int arm_init(void)
{
- int rc = kvm_init(NULL, sizeof(struct kvm_vcpu), 0, THIS_MODULE);
+ int rc = kvm_init_usercopy(NULL, sizeof(struct kvm_vcpu), 0,
+ offsetof(struct kvm_vcpu_arch, ctxt),
+ sizeof_field(struct kvm_vcpu_arch, ctxt),
+ THIS_MODULE);
return rc;
}
--
2.14.2
_______________________________________________
kvmarm mailing list
kvmarm@lists.cs.columbia.edu
https://lists.cs.columbia.edu/mailman/listinfo/kvmarm
WARNING: multiple messages have this Message-ID (diff)
From: christoffer.dall@linaro.org (Christoffer Dall)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH] KVM: arm/arm64: Allow usercopy to vcpu->arch.ctxt and arm64 debug
Date: Sat, 21 Oct 2017 20:45:45 +0200 [thread overview]
Message-ID: <20171021184545.2497-1-christoffer.dall@linaro.org> (raw)
In-Reply-To: <20171020232525.7387-1-pbonzini@redhat.com>
We do direct useraccess copying to the kvm_cpu_context structure
embedded in the kvm_vcpu_arch structure, and to the vcpu debug register
state. Everything else (timer, PMU, vgic) goes through a temporary
indirection.
Fixing all accesses to kvm_cpu_context is massively invasive, and we'd
like to avoid that, so we tell kvm_init_usercopy to whitelist accesses
to out context structure.
The debug system register accesses on arm64 are modified to work through
an indirection instead.
Cc: kernel-hardening at lists.openwall.com
Cc: Kees Cook <keescook@chromium.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Kr?m?? <rkrcmar@redhat.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
---
This fixes KVM/ARM on today's linux next with CONFIG_HARDENED_USERCOPY.
The patch is based on linux-next plus Paolo's x86 patch which introduces
kvm_init_usercopy. Not sure how this needs to get merged, but it would
potentially make sense for Paolo to put together a set of the patches
needed for this.
Thanks,
-Christoffer
arch/arm64/kvm/sys_regs.c | 36 ++++++++++++++++++++----------------
virt/kvm/arm/arm.c | 5 ++++-
2 files changed, 24 insertions(+), 17 deletions(-)
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 2e070d3baf9f..cdf47a9108fe 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -293,19 +293,20 @@ static bool trap_bvr(struct kvm_vcpu *vcpu,
static int set_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg] = r;
return 0;
}
static int get_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -335,10 +336,11 @@ static bool trap_bcr(struct kvm_vcpu *vcpu,
static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg] = r;
return 0;
}
@@ -346,9 +348,9 @@ static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
static int get_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -379,19 +381,20 @@ static bool trap_wvr(struct kvm_vcpu *vcpu,
static int set_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg] = r;
return 0;
}
static int get_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -421,19 +424,20 @@ static bool trap_wcr(struct kvm_vcpu *vcpu,
static int set_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg] = r;
return 0;
}
static int get_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index b9f68e4add71..639e388678ff 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -1502,7 +1502,10 @@ void kvm_arch_exit(void)
static int arm_init(void)
{
- int rc = kvm_init(NULL, sizeof(struct kvm_vcpu), 0, THIS_MODULE);
+ int rc = kvm_init_usercopy(NULL, sizeof(struct kvm_vcpu), 0,
+ offsetof(struct kvm_vcpu_arch, ctxt),
+ sizeof_field(struct kvm_vcpu_arch, ctxt),
+ THIS_MODULE);
return rc;
}
--
2.14.2
WARNING: multiple messages have this Message-ID (diff)
From: Christoffer Dall <christoffer.dall@linaro.org>
To: kvmarm@lists.cs.columbia.edu
Cc: linux-arm-kernel@lists.infradead.org, kvm@vger.kernel.org,
"Christoffer Dall" <christoffer.dall@linaro.org>,
kernel-hardening@lists.openwall.com,
"Kees Cook" <keescook@chromium.org>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Radim Krčmář" <rkrcmar@redhat.com>,
"Marc Zyngier" <marc.zyngier@arm.com>
Subject: [kernel-hardening] [PATCH] KVM: arm/arm64: Allow usercopy to vcpu->arch.ctxt and arm64 debug
Date: Sat, 21 Oct 2017 20:45:45 +0200 [thread overview]
Message-ID: <20171021184545.2497-1-christoffer.dall@linaro.org> (raw)
In-Reply-To: <20171020232525.7387-1-pbonzini@redhat.com>
We do direct useraccess copying to the kvm_cpu_context structure
embedded in the kvm_vcpu_arch structure, and to the vcpu debug register
state. Everything else (timer, PMU, vgic) goes through a temporary
indirection.
Fixing all accesses to kvm_cpu_context is massively invasive, and we'd
like to avoid that, so we tell kvm_init_usercopy to whitelist accesses
to out context structure.
The debug system register accesses on arm64 are modified to work through
an indirection instead.
Cc: kernel-hardening@lists.openwall.com
Cc: Kees Cook <keescook@chromium.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
---
This fixes KVM/ARM on today's linux next with CONFIG_HARDENED_USERCOPY.
The patch is based on linux-next plus Paolo's x86 patch which introduces
kvm_init_usercopy. Not sure how this needs to get merged, but it would
potentially make sense for Paolo to put together a set of the patches
needed for this.
Thanks,
-Christoffer
arch/arm64/kvm/sys_regs.c | 36 ++++++++++++++++++++----------------
virt/kvm/arm/arm.c | 5 ++++-
2 files changed, 24 insertions(+), 17 deletions(-)
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 2e070d3baf9f..cdf47a9108fe 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -293,19 +293,20 @@ static bool trap_bvr(struct kvm_vcpu *vcpu,
static int set_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg] = r;
return 0;
}
static int get_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -335,10 +336,11 @@ static bool trap_bcr(struct kvm_vcpu *vcpu,
static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg] = r;
return 0;
}
@@ -346,9 +348,9 @@ static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
static int get_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -379,19 +381,20 @@ static bool trap_wvr(struct kvm_vcpu *vcpu,
static int set_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg] = r;
return 0;
}
static int get_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
@@ -421,19 +424,20 @@ static bool trap_wcr(struct kvm_vcpu *vcpu,
static int set_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
+ __u64 r;
- if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
+ vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg] = r;
return 0;
}
static int get_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
const struct kvm_one_reg *reg, void __user *uaddr)
{
- __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
+ __u64 r = vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
- if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+ if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0)
return -EFAULT;
return 0;
}
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index b9f68e4add71..639e388678ff 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -1502,7 +1502,10 @@ void kvm_arch_exit(void)
static int arm_init(void)
{
- int rc = kvm_init(NULL, sizeof(struct kvm_vcpu), 0, THIS_MODULE);
+ int rc = kvm_init_usercopy(NULL, sizeof(struct kvm_vcpu), 0,
+ offsetof(struct kvm_vcpu_arch, ctxt),
+ sizeof_field(struct kvm_vcpu_arch, ctxt),
+ THIS_MODULE);
return rc;
}
--
2.14.2
next prev parent reply other threads:[~2017-10-21 18:45 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-20 23:25 [PATCH 0/2] KVM: fixes for the kernel-hardening tree Paolo Bonzini
2017-10-20 23:25 ` [kernel-hardening] " Paolo Bonzini
2017-10-20 23:25 ` [PATCH 1/2] KVM: allow setting a usercopy region in struct kvm_vcpu Paolo Bonzini
2017-10-20 23:25 ` [kernel-hardening] " Paolo Bonzini
2017-10-21 14:53 ` Kees Cook
2017-10-21 14:53 ` [kernel-hardening] " Kees Cook
2017-10-20 23:25 ` [PATCH 2/2] KVM: fix KVM_XEN_HVM_CONFIG ioctl Paolo Bonzini
2017-10-20 23:25 ` [kernel-hardening] " Paolo Bonzini
2017-10-21 18:45 ` Christoffer Dall [this message]
2017-10-21 18:45 ` [kernel-hardening] [PATCH] KVM: arm/arm64: Allow usercopy to vcpu->arch.ctxt and arm64 debug Christoffer Dall
2017-10-21 18:45 ` Christoffer Dall
2017-10-22 3:06 ` Kees Cook
2017-10-22 3:06 ` [kernel-hardening] " Kees Cook
2017-10-22 3:06 ` Kees Cook
2017-10-22 7:44 ` Christoffer Dall
2017-10-22 7:44 ` [kernel-hardening] " Christoffer Dall
2017-10-22 7:44 ` Christoffer Dall
2017-10-23 14:14 ` Paolo Bonzini
2017-10-23 14:14 ` [kernel-hardening] " Paolo Bonzini
2017-10-23 14:14 ` Paolo Bonzini
2017-10-23 14:49 ` Christoffer Dall
2017-10-23 14:49 ` [kernel-hardening] " Christoffer Dall
2017-10-23 14:49 ` Christoffer Dall
2017-10-23 19:40 ` Kees Cook
2017-10-23 19:40 ` [kernel-hardening] " Kees Cook
2017-10-23 19:40 ` Kees Cook
2017-10-23 21:06 ` R: " Paolo Bonzini
2017-10-23 21:06 ` [kernel-hardening] " Paolo Bonzini
2017-10-23 21:06 ` Paolo Bonzini
2017-10-22 7:48 ` [PATCH v2] " Christoffer Dall
2017-10-22 7:48 ` Christoffer Dall
2017-10-23 9:52 ` [PATCH 0/2] KVM: fixes for the kernel-hardening tree David Hildenbrand
2017-10-23 9:52 ` [kernel-hardening] " David Hildenbrand
2017-10-23 11:10 ` Christian Borntraeger
2017-10-23 11:10 ` [kernel-hardening] " Christian Borntraeger
2017-10-23 12:39 ` Cornelia Huck
2017-10-23 12:39 ` [kernel-hardening] " Cornelia Huck
2017-10-23 14:15 ` Paolo Bonzini
2017-10-23 14:15 ` [kernel-hardening] " Paolo Bonzini
2017-10-25 9:45 ` David Hildenbrand
2017-10-25 9:45 ` [kernel-hardening] " David Hildenbrand
2017-10-25 10:31 ` Christian Borntraeger
2017-10-25 10:31 ` [kernel-hardening] " Christian Borntraeger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171021184545.2497-1-christoffer.dall@linaro.org \
--to=christoffer.dall@linaro.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=marc.zyngier@arm.com \
--cc=pbonzini@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.