From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932384AbdJZOWC (ORCPT ); Thu, 26 Oct 2017 10:22:02 -0400 Received: from mail-pg0-f65.google.com ([74.125.83.65]:45838 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932246AbdJZOWA (ORCPT ); Thu, 26 Oct 2017 10:22:00 -0400 X-Google-Smtp-Source: ABhQp+TT+j0BvCTgPAlzxYpF73fpVB/Kft5kqpgo0pj48skfFxOPkvEPXxULJe82EKbNev6jWOXSdMDnSkfEzoMlYZg= MIME-Version: 1.0 In-Reply-To: <20171026134547.23664-2-pbonzini@redhat.com> References: <20171026134547.23664-1-pbonzini@redhat.com> <20171026134547.23664-2-pbonzini@redhat.com> From: Christoffer Dall Date: Thu, 26 Oct 2017 16:21:59 +0200 Message-ID: Subject: Re: [PATCH 1/2] kvm: whitelist struct kvm_vcpu_arch To: Paolo Bonzini Cc: "linux-kernel@vger.kernel.org" , "kvm@vger.kernel.org" , Marc Zyngier , Christian Borntraeger , Cornelia Huck , James Hogan , Paul Mackerras , kernel-hardening@lists.openwall.com, Kees Cook , Christian Borntraeger , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v9QEM6WM013962 On Thu, Oct 26, 2017 at 3:45 PM, Paolo Bonzini wrote: > On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. > > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. > > Cc: kernel-hardening@lists.openwall.com > Cc: Kees Cook > Cc: Christian Borntraeger > Cc: Christoffer Dall > Cc: Radim Krčmář > Signed-off-by: Paolo Bonzini > --- > virt/kvm/kvm_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 4d81f6ded88e..b4809ccfdfa1 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -4005,8 +4005,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, > /* A kmem cache lets us meet the alignment requirements of fx_save. */ > if (!vcpu_align) > vcpu_align = __alignof__(struct kvm_vcpu); > - kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, > - 0, NULL); > + kvm_vcpu_cache = > + kmem_cache_create_usercopy("kvm_vcpu", > + sizeof(struct kvm_vcpu), vcpu_align, > + 0, offsetof(struct kvm_vcpu, arch), > + sizeof_field(struct kvm_vcpu, arch), > + NULL); > if (!kvm_vcpu_cache) { > r = -ENOMEM; > goto out_free_3; > -- > 2.14.2 Acked-by: Christoffer Dall From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 In-Reply-To: <20171026134547.23664-2-pbonzini@redhat.com> References: <20171026134547.23664-1-pbonzini@redhat.com> <20171026134547.23664-2-pbonzini@redhat.com> From: Christoffer Dall Date: Thu, 26 Oct 2017 16:21:59 +0200 Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Subject: [kernel-hardening] Re: [PATCH 1/2] kvm: whitelist struct kvm_vcpu_arch To: Paolo Bonzini Cc: "linux-kernel@vger.kernel.org" , "kvm@vger.kernel.org" , Marc Zyngier , Christian Borntraeger , Cornelia Huck , James Hogan , Paul Mackerras , kernel-hardening@lists.openwall.com, Kees Cook , Christian Borntraeger , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= List-ID: On Thu, Oct 26, 2017 at 3:45 PM, Paolo Bonzini wrote: > On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. > > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. > > Cc: kernel-hardening@lists.openwall.com > Cc: Kees Cook > Cc: Christian Borntraeger > Cc: Christoffer Dall > Cc: Radim Kr=C4=8Dm=C3=A1=C5=99 > Signed-off-by: Paolo Bonzini > --- > virt/kvm/kvm_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 4d81f6ded88e..b4809ccfdfa1 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -4005,8 +4005,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, uns= igned vcpu_align, > /* A kmem cache lets us meet the alignment requirements of fx_sav= e. */ > if (!vcpu_align) > vcpu_align =3D __alignof__(struct kvm_vcpu); > - kvm_vcpu_cache =3D kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_= align, > - 0, NULL); > + kvm_vcpu_cache =3D > + kmem_cache_create_usercopy("kvm_vcpu", > + sizeof(struct kvm_vcpu), vcpu_= align, > + 0, offsetof(struct kvm_vcpu, a= rch), > + sizeof_field(struct kvm_vcpu, = arch), > + NULL); > if (!kvm_vcpu_cache) { > r =3D -ENOMEM; > goto out_free_3; > -- > 2.14.2 Acked-by: Christoffer Dall