From: Christian Borntraeger <borntraeger@de.ibm.com> To: Paolo Bonzini <pbonzini@redhat.com>, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: "Christoffer Dall" <christoffer.dall@linaro.org>, "Marc Zyngier" <marc.zyngier@arm.com>, "Cornelia Huck" <cohuck@redhat.com>, "James Hogan" <james.hogan@imgtec.com>, "Paul Mackerras" <paulus@samba.org>, kernel-hardening@lists.openwall.com, "Kees Cook" <keescook@chromium.org>, "Christian Borntraeger" <borntraeger@redhat.com>, "Christoffer Dall" <cdall@linaro.org>, "Radim Krčmář" <rkrcmar@redhat.com> Subject: Re: [PATCH 1/2] kvm: whitelist struct kvm_vcpu_arch Date: Thu, 26 Oct 2017 16:51:38 +0200 [thread overview] Message-ID: <15c32f0a-9a51-4f88-7636-182397d7770e@de.ibm.com> (raw) In-Reply-To: <20171026134547.23664-2-pbonzini@redhat.com> On 10/26/2017 03:45 PM, Paolo Bonzini wrote: > On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. > > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. > > Cc: kernel-hardening@lists.openwall.com > Cc: Kees Cook <keescook@chromium.org> > Cc: Christian Borntraeger <borntraeger@redhat.com> You wish? Not yet Paolo :-) > Cc: Christoffer Dall <cdall@linaro.org> > Cc: Radim Krčmář <rkrcmar@redhat.com> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> > --- > virt/kvm/kvm_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 4d81f6ded88e..b4809ccfdfa1 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -4005,8 +4005,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, > /* A kmem cache lets us meet the alignment requirements of fx_save. */ > if (!vcpu_align) > vcpu_align = __alignof__(struct kvm_vcpu); > - kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, > - 0, NULL); > + kvm_vcpu_cache = > + kmem_cache_create_usercopy("kvm_vcpu", > + sizeof(struct kvm_vcpu), vcpu_align, > + 0, offsetof(struct kvm_vcpu, arch), > + sizeof_field(struct kvm_vcpu, arch), > + NULL); > if (!kvm_vcpu_cache) { > r = -ENOMEM; > goto out_free_3; >
WARNING: multiple messages have this Message-ID (diff)
From: Christian Borntraeger <borntraeger@de.ibm.com> To: Paolo Bonzini <pbonzini@redhat.com>, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: "Christoffer Dall" <christoffer.dall@linaro.org>, "Marc Zyngier" <marc.zyngier@arm.com>, "Cornelia Huck" <cohuck@redhat.com>, "James Hogan" <james.hogan@imgtec.com>, "Paul Mackerras" <paulus@samba.org>, kernel-hardening@lists.openwall.com, "Kees Cook" <keescook@chromium.org>, "Christian Borntraeger" <borntraeger@redhat.com>, "Christoffer Dall" <cdall@linaro.org>, "Radim Krčmář" <rkrcmar@redhat.com> Subject: [kernel-hardening] Re: [PATCH 1/2] kvm: whitelist struct kvm_vcpu_arch Date: Thu, 26 Oct 2017 16:51:38 +0200 [thread overview] Message-ID: <15c32f0a-9a51-4f88-7636-182397d7770e@de.ibm.com> (raw) In-Reply-To: <20171026134547.23664-2-pbonzini@redhat.com> On 10/26/2017 03:45 PM, Paolo Bonzini wrote: > On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. > > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. > > Cc: kernel-hardening@lists.openwall.com > Cc: Kees Cook <keescook@chromium.org> > Cc: Christian Borntraeger <borntraeger@redhat.com> You wish? Not yet Paolo :-) > Cc: Christoffer Dall <cdall@linaro.org> > Cc: Radim Krčmář <rkrcmar@redhat.com> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> > --- > virt/kvm/kvm_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 4d81f6ded88e..b4809ccfdfa1 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -4005,8 +4005,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, > /* A kmem cache lets us meet the alignment requirements of fx_save. */ > if (!vcpu_align) > vcpu_align = __alignof__(struct kvm_vcpu); > - kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, > - 0, NULL); > + kvm_vcpu_cache = > + kmem_cache_create_usercopy("kvm_vcpu", > + sizeof(struct kvm_vcpu), vcpu_align, > + 0, offsetof(struct kvm_vcpu, arch), > + sizeof_field(struct kvm_vcpu, arch), > + NULL); > if (!kvm_vcpu_cache) { > r = -ENOMEM; > goto out_free_3; >
next prev parent reply other threads:[~2017-10-26 14:51 UTC|newest] Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-10-26 13:45 [PATCH v2 0/2] KVM: fixes for the kernel-hardening tree Paolo Bonzini 2017-10-26 13:45 ` [kernel-hardening] " Paolo Bonzini 2017-10-26 13:45 ` [PATCH 1/2] kvm: whitelist struct kvm_vcpu_arch Paolo Bonzini 2017-10-26 13:45 ` [kernel-hardening] " Paolo Bonzini 2017-10-26 14:13 ` Cornelia Huck 2017-10-26 14:13 ` [kernel-hardening] " Cornelia Huck 2017-10-26 14:21 ` Christoffer Dall 2017-10-26 14:21 ` [kernel-hardening] " Christoffer Dall 2017-10-26 14:34 ` Marc Zyngier 2017-10-26 14:34 ` [kernel-hardening] " Marc Zyngier 2017-10-26 14:51 ` Christian Borntraeger [this message] 2017-10-26 14:51 ` Christian Borntraeger 2017-10-30 23:28 ` [kernel-hardening] " Eric Biggers 2017-10-30 23:51 ` Kees Cook 2017-10-26 13:45 ` [PATCH 2/2] kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl Paolo Bonzini 2017-10-26 13:45 ` [kernel-hardening] " Paolo Bonzini 2017-10-26 13:48 ` Kees Cook 2017-10-26 13:48 ` [kernel-hardening] " Kees Cook 2017-11-30 20:40 ` Kees Cook 2017-11-30 20:40 ` [kernel-hardening] " Kees Cook 2017-12-01 8:29 ` Paolo Bonzini 2017-12-01 8:29 ` [kernel-hardening] " Paolo Bonzini 2017-10-27 5:25 ` [PATCH v2 0/2] KVM: fixes for the kernel-hardening tree Paul Mackerras 2017-10-27 5:25 ` [kernel-hardening] " Paul Mackerras
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=15c32f0a-9a51-4f88-7636-182397d7770e@de.ibm.com \ --to=borntraeger@de.ibm.com \ --cc=borntraeger@redhat.com \ --cc=cdall@linaro.org \ --cc=christoffer.dall@linaro.org \ --cc=cohuck@redhat.com \ --cc=james.hogan@imgtec.com \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=kvm@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=marc.zyngier@arm.com \ --cc=paulus@samba.org \ --cc=pbonzini@redhat.com \ --cc=rkrcmar@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.