From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Will Deacon <will@kernel.org>
Cc: kvm@vger.kernel.org, kernellwp@gmail.com,
linux-kernel@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>,
"# 5 . 2 . y" <stable@kernel.org>
Subject: Re: [PATCH] kvm: Ensure writes to the coalesced MMIO ring are within bounds
Date: Wed, 18 Sep 2019 15:30:47 +0200 [thread overview]
Message-ID: <20190918133047.GC1908968@kroah.com> (raw)
In-Reply-To: <20190918131545.6405-1-will@kernel.org>
On Wed, Sep 18, 2019 at 02:15:45PM +0100, Will Deacon wrote:
> When records are written to the coalesced MMIO ring in response to a
> vCPU MMIO exit, the 'ring->last' field is used to index the ring buffer
> page. Although we hold the 'kvm->ring_lock' at this point, the ring
> structure is mapped directly into the host userspace and can therefore
> be modified to point at arbitrary pages within the kernel.
>
> Since this shouldn't happen in normal operation, simply bound the index
> by KVM_COALESCED_MMIO_MAX to contain the accesses within the ring buffer
> page.
>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: <stable@kernel.org> # 5.2.y
> Fixes: 5f94c1741bdc ("KVM: Add coalesced MMIO support (common part)")
> Reported-by: Bill Creasey <bcreasey@google.com>
> Signed-off-by: Will Deacon <will@kernel.org>
> ---
>
> I think there are some other fixes kicking around for this, but they
> still rely on 'ring->last' being stable, which isn't necessarily the
> case. I'll send the -stable backport for kernels prior to 5.2 once this
> hits mainline.
>
> virt/kvm/coalesced_mmio.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
> index 5294abb3f178..09b3e4421550 100644
> --- a/virt/kvm/coalesced_mmio.c
> +++ b/virt/kvm/coalesced_mmio.c
> @@ -67,6 +67,7 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu,
> {
> struct kvm_coalesced_mmio_dev *dev = to_mmio(this);
> struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;
> + u32 last;
>
> if (!coalesced_mmio_in_range(dev, addr, len))
> return -EOPNOTSUPP;
> @@ -79,13 +80,13 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu,
> }
>
> /* copy data in first free entry of the ring */
> -
> - ring->coalesced_mmio[ring->last].phys_addr = addr;
> - ring->coalesced_mmio[ring->last].len = len;
> - memcpy(ring->coalesced_mmio[ring->last].data, val, len);
> - ring->coalesced_mmio[ring->last].pio = dev->zone.pio;
> + last = ring->last % KVM_COALESCED_MMIO_MAX;
> + ring->coalesced_mmio[last].phys_addr = addr;
> + ring->coalesced_mmio[last].len = len;
> + memcpy(ring->coalesced_mmio[last].data, val, len);
> + ring->coalesced_mmio[last].pio = dev->zone.pio;
> smp_wmb();
> - ring->last = (ring->last + 1) % KVM_COALESCED_MMIO_MAX;
> + ring->last = (last + 1) % KVM_COALESCED_MMIO_MAX;
> spin_unlock(&dev->kvm->ring_lock);
> return 0;
> }
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
next prev parent reply other threads:[~2019-09-18 13:30 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-18 13:15 [PATCH] kvm: Ensure writes to the coalesced MMIO ring are within bounds Will Deacon
2019-09-18 13:30 ` Greg Kroah-Hartman [this message]
2019-09-18 13:41 ` Paolo Bonzini
2019-09-18 13:59 ` Will Deacon
2019-09-18 14:11 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190918133047.GC1908968@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=kernellwp@gmail.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=stable@kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).