From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932399AbdJZONx convert rfc822-to-8bit (ORCPT ); Thu, 26 Oct 2017 10:13:53 -0400 Received: from mx1.redhat.com ([209.132.183.28]:51366 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932291AbdJZONs (ORCPT ); Thu, 26 Oct 2017 10:13:48 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com D4E2B68D9 Authentication-Results: ext-mx09.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx09.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=cohuck@redhat.com Date: Thu, 26 Oct 2017 16:13:42 +0200 From: Cornelia Huck To: Paolo Bonzini Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Christoffer Dall , Marc Zyngier , Christian Borntraeger , James Hogan , Paul Mackerras , kernel-hardening@lists.openwall.com, Kees Cook , Christoffer Dall , Radim =?UTF-8?B?S3LEjW3DocWZ?= Subject: Re: [PATCH 1/2] kvm: whitelist struct kvm_vcpu_arch Message-ID: <20171026161242.017bcb9b.cohuck@redhat.com> In-Reply-To: <20171026134547.23664-2-pbonzini@redhat.com> References: <20171026134547.23664-1-pbonzini@redhat.com> <20171026134547.23664-2-pbonzini@redhat.com> Organization: Red Hat GmbH MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Thu, 26 Oct 2017 14:13:48 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 26 Oct 2017 15:45:46 +0200 Paolo Bonzini wrote: > On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. > > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. > > Cc: kernel-hardening@lists.openwall.com > Cc: Kees Cook > Cc: Christian Borntraeger > Cc: Christoffer Dall > Cc: Radim Krčmář > Signed-off-by: Paolo Bonzini > --- > virt/kvm/kvm_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 4d81f6ded88e..b4809ccfdfa1 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -4005,8 +4005,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, > /* A kmem cache lets us meet the alignment requirements of fx_save. */ > if (!vcpu_align) > vcpu_align = __alignof__(struct kvm_vcpu); > - kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, > - 0, NULL); > + kvm_vcpu_cache = > + kmem_cache_create_usercopy("kvm_vcpu", > + sizeof(struct kvm_vcpu), vcpu_align, > + 0, offsetof(struct kvm_vcpu, arch), > + sizeof_field(struct kvm_vcpu, arch), > + NULL); > if (!kvm_vcpu_cache) { > r = -ENOMEM; > goto out_free_3; Acked-by: Cornelia Huck From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Thu, 26 Oct 2017 16:13:42 +0200 From: Cornelia Huck Message-ID: <20171026161242.017bcb9b.cohuck@redhat.com> In-Reply-To: <20171026134547.23664-2-pbonzini@redhat.com> References: <20171026134547.23664-1-pbonzini@redhat.com> <20171026134547.23664-2-pbonzini@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [kernel-hardening] Re: [PATCH 1/2] kvm: whitelist struct kvm_vcpu_arch To: Paolo Bonzini Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Christoffer Dall , Marc Zyngier , Christian Borntraeger , James Hogan , Paul Mackerras , kernel-hardening@lists.openwall.com, Kees Cook , Christoffer Dall , Radim =?UTF-8?B?S3LEjW3DocWZ?= List-ID: On Thu, 26 Oct 2017 15:45:46 +0200 Paolo Bonzini wrote: > On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. >=20 > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. >=20 > Cc: kernel-hardening@lists.openwall.com > Cc: Kees Cook > Cc: Christian Borntraeger > Cc: Christoffer Dall > Cc: Radim Kr=C4=8Dm=C3=A1=C5=99 > Signed-off-by: Paolo Bonzini > --- > virt/kvm/kvm_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) >=20 > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 4d81f6ded88e..b4809ccfdfa1 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -4005,8 +4005,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, uns= igned vcpu_align, > /* A kmem cache lets us meet the alignment requirements of fx_save. */ > if (!vcpu_align) > vcpu_align =3D __alignof__(struct kvm_vcpu); > - kvm_vcpu_cache =3D kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, > - 0, NULL); > + kvm_vcpu_cache =3D > + kmem_cache_create_usercopy("kvm_vcpu", > + sizeof(struct kvm_vcpu), vcpu_align, > + 0, offsetof(struct kvm_vcpu, arch), > + sizeof_field(struct kvm_vcpu, arch), > + NULL); > if (!kvm_vcpu_cache) { > r =3D -ENOMEM; > goto out_free_3; Acked-by: Cornelia Huck