From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sean Christopherson Date: Mon, 30 Oct 2023 15:12:10 -0700 Subject: [PATCH v13 08/35] KVM: Introduce KVM_SET_USER_MEMORY_REGION2 In-Reply-To: References: <20231027182217.3615211-1-seanjc@google.com> <20231027182217.3615211-9-seanjc@google.com> <211d093f-4023-4a39-a23f-6d8543512675@redhat.com> Message-ID: List-Id: To: kvm-riscv@lists.infradead.org MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit On Mon, Oct 30, 2023, Sean Christopherson wrote: > On Mon, Oct 30, 2023, Paolo Bonzini wrote: > > On 10/27/23 20:21, Sean Christopherson wrote: > > > > > > + if (ioctl == KVM_SET_USER_MEMORY_REGION) > > > + size = sizeof(struct kvm_userspace_memory_region); > > > > This also needs a memset(&mem, 0, sizeof(mem)), otherwise the out-of-bounds > > access of the commit message becomes a kernel stack read. > > Ouch. There's some irony. Might be worth doing memset(&mem, -1, sizeof(mem)) > though as '0' is a valid file descriptor and a valid file offset. > > > Probably worth adding a check on valid flags here. > > Definitely needed. There's a very real bug here. But rather than duplicate flags > checking or plumb @ioctl all the way to __kvm_set_memory_region(), now that we > have the fancy guard(mutex) and there are no internal calls to kvm_set_memory_region(), > what if we: > > 1. Acquire/release slots_lock in __kvm_set_memory_region() Gah, this won't work with x86's usage, which acquire slots_lock quite far away from __kvm_set_memory_region() in several places. The rest of the idea still works, kvm_vm_ioctl_set_memory_region() will just need to take slots_lock manually. > 2. Call kvm_set_memory_region() from x86 code for the internal memslots > 3. Disallow *any* flags for internal memslots > 4. Open code check_memory_region_flags in kvm_vm_ioctl_set_memory_region() > 5. Pass @ioctl to kvm_vm_ioctl_set_memory_region() and allow KVM_MEM_PRIVATE > only for KVM_SET_USER_MEMORY_REGION2 From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D051C23C3 for ; Mon, 30 Oct 2023 22:12:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="0dwNFwP1" Received: by mail-pf1-f202.google.com with SMTP id d2e1a72fcca58-6b2018a11e2so5038136b3a.2 for ; Mon, 30 Oct 2023 15:12:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1698703932; x=1699308732; darn=lists.linux.dev; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=g8DEvtikhnQyn+T5K55cZjm1cs6/IKtx/WCyiBBil5U=; b=0dwNFwP1lbNvd42qtmDeI0BJSqJf40xYCCH9Nqxtz6raeQyufFyqp4SNN3GKtK8/BR taUzoB2hXZfb+42E4pf867jxo6KnxNXA6a1FkSmvdVkMOHCPXf/KRSx+USBjMD6JtIcN dmuyefPh3p/MW1WS3Lb5FuExYZtor8YTZylB+RWzUJXPl3ECT5y+Bwei+8PN3YEXMEFU gBVa2BqFtzbpdbWJ69Ctzj2hbcE/L97L0bS/TqBYUpSa9EPaaOS3BVrh+vkPBoKTv8ju fBfVjF0vXtZG9vdguOJI2dLvLuceWfIaZe1YnH86ASXFhTz0ua+D/jZmvA6DfEVdk7LB 20yA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1698703932; x=1699308732; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=g8DEvtikhnQyn+T5K55cZjm1cs6/IKtx/WCyiBBil5U=; b=UbRHnl+C7f7w88TBFFvvBDS0sQnS3XQfRrB2E9inandLqs2fFFhZBokF4LSKGoAc8L ljPy572d/pqQwYYeeGNskvJ5YG0QQYZWJahsb7X0VwokA9RN7zttKvyiFi5bT70o24l4 gih95Sh9j1HGKMNmE5JJQwjBHNMjuCdUfHRBeqGe2tgQh/u+WTXlbRmIclTkU3HoCAu4 KqJsFLMz7E7R+VqL+VSvZBJW2vA1NvpjVeEuEX0UT6pusXvddbzv78V3DBTIe+eCmHAf Zghoba//L+e/YyR9rnDRn1QO37gl3ac5YgC6PJ0dx+ZDVyJgND2SI7odRvKpFqfSNTv3 4SkA== X-Gm-Message-State: AOJu0YzQ1g/KOrDAso+HujWEhvRirHWyJ6YBNbHyojA1OoAQZ+UnEld3 kt1xYx3xHK9YEfLR38ZB/sakXDnxNjA= X-Google-Smtp-Source: AGHT+IGGcxVYGAYGv3uCrE8wHX1TR4p8IURd9gUNgfJNwa+fo9vdIR8HGGPD/6eLST5HVrX+Zf4WM1nECms= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6a00:1755:b0:68e:24fe:d9a with SMTP id j21-20020a056a00175500b0068e24fe0d9amr205380pfc.2.1698703932137; Mon, 30 Oct 2023 15:12:12 -0700 (PDT) Date: Mon, 30 Oct 2023 15:12:10 -0700 In-Reply-To: Precedence: bulk X-Mailing-List: kvmarm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20231027182217.3615211-1-seanjc@google.com> <20231027182217.3615211-9-seanjc@google.com> <211d093f-4023-4a39-a23f-6d8543512675@redhat.com> Message-ID: Subject: Re: [PATCH v13 08/35] KVM: Introduce KVM_SET_USER_MEMORY_REGION2 From: Sean Christopherson To: Paolo Bonzini Cc: Marc Zyngier , Oliver Upton , Huacai Chen , Michael Ellerman , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexander Viro , Christian Brauner , "Matthew Wilcox (Oracle)" , Andrew Morton , kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-mips@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Xiaoyao Li , Xu Yilun , Chao Peng , Fuad Tabba , Jarkko Sakkinen , Anish Moorthy , David Matlack , Yu Zhang , Isaku Yamahata , "=?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?=" , Vlastimil Babka , Vishal Annapurve , Ackerley Tng , Maciej Szmigiero , David Hildenbrand , Quentin Perret , Michael Roth , Wang , Liam Merwick , Isaku Yamahata , "Kirill A . Shutemov" Content-Type: text/plain; charset="us-ascii" On Mon, Oct 30, 2023, Sean Christopherson wrote: > On Mon, Oct 30, 2023, Paolo Bonzini wrote: > > On 10/27/23 20:21, Sean Christopherson wrote: > > > > > > + if (ioctl == KVM_SET_USER_MEMORY_REGION) > > > + size = sizeof(struct kvm_userspace_memory_region); > > > > This also needs a memset(&mem, 0, sizeof(mem)), otherwise the out-of-bounds > > access of the commit message becomes a kernel stack read. > > Ouch. There's some irony. Might be worth doing memset(&mem, -1, sizeof(mem)) > though as '0' is a valid file descriptor and a valid file offset. > > > Probably worth adding a check on valid flags here. > > Definitely needed. There's a very real bug here. But rather than duplicate flags > checking or plumb @ioctl all the way to __kvm_set_memory_region(), now that we > have the fancy guard(mutex) and there are no internal calls to kvm_set_memory_region(), > what if we: > > 1. Acquire/release slots_lock in __kvm_set_memory_region() Gah, this won't work with x86's usage, which acquire slots_lock quite far away from __kvm_set_memory_region() in several places. The rest of the idea still works, kvm_vm_ioctl_set_memory_region() will just need to take slots_lock manually. > 2. Call kvm_set_memory_region() from x86 code for the internal memslots > 3. Disallow *any* flags for internal memslots > 4. Open code check_memory_region_flags in kvm_vm_ioctl_set_memory_region() > 5. Pass @ioctl to kvm_vm_ioctl_set_memory_region() and allow KVM_MEM_PRIVATE > only for KVM_SET_USER_MEMORY_REGION2 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BD420C4167B for ; Mon, 30 Oct 2023 22:12:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID: References:Mime-Version:In-Reply-To:Date:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=evQL3N+B56djeldI/bt6zp+lefebB6m/LcqvPv2Dorw=; b=GWXeNJBDp/sBSksgrm+9gC6q1Y Lqco7IQewqZaDAtDs6QgRZIWD5JjwHQ18hnn43S5kppZ1QvsQx5aT/X+G4jMC6YI46K5rke0Qd8H6 VMN0bmzPpW4hGbLBax5YHhf4f1ERfFUywMY4HaAl5L9iUMGe2zJWzQe7wQR37BwbncWfQLxTMap0M YJ2hogVtsswINf1DApJ8+irO1isbYzVYMXnxkSzZNXcuHoRHjNsIp2zItMBy7vm95G8BqCS1Ey+6x F5hWb0uJMAz37qYfi17858DOOhagyX8mr/8d8KrJGGWZSaAUYrUzNr/WKB/Z0pZn6plbqxK8mQ4E0 10znXqxg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qxaUa-0047er-2x; Mon, 30 Oct 2023 22:12:16 +0000 Received: from mail-pf1-x449.google.com ([2607:f8b0:4864:20::449]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qxaUX-0047d9-2l for linux-riscv@lists.infradead.org; Mon, 30 Oct 2023 22:12:15 +0000 Received: by mail-pf1-x449.google.com with SMTP id d2e1a72fcca58-6b2018a11e2so5038137b3a.2 for ; Mon, 30 Oct 2023 15:12:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1698703932; x=1699308732; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=g8DEvtikhnQyn+T5K55cZjm1cs6/IKtx/WCyiBBil5U=; b=F/siSCEIdYnFxGTDeSbz/y5gnYv4X51buZ9WzLV9O0LAUBVDkxXXYS1THKF6HlsxSv QG1IsiUiE4zzQ04R1cMT0Ib7grVRuC8E6ciSsypgaHoPAdLH53Za1LCF54piEqfgGF/4 s+VMxb0FawY3UvE7lvhrdrTj6HFcmxxdvueHeokG2b60qifwYZ3KbqvoCz2CZccGSU49 n898xozT6+vJsHAGvopQseuBjSwXApfdPGtb0R+Ax6XKX0esq3eTbd240AnKxXwchMRJ oQ7+7yNMChcdQF7WnadPdVE28b5RcQ91XrEeZvRvw1a5HA/+eBHqxvyBtLtvDvuW82T2 6X3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1698703932; x=1699308732; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=g8DEvtikhnQyn+T5K55cZjm1cs6/IKtx/WCyiBBil5U=; b=k4Yw2mzpijvp/Dq60D7IbG15Q0KZ59Huo3rckersdZq3tE825CTdcnhegLmXXkVeSE P/34VEYoDfXKUyA7Sugv0B+GUB3n/ZfPUu49NlQExjtcUjuZ/orumhLme+szPbYy4wJe SPkYAB7yARWtaHlFNGAa5tZS3s1Jw8ldlE5npmlh//4IZyJfL/Q6hjAAUssBF6OXeSRb Ie0Vl6J9A1u3FmMBTAn9E78oc5o0Djp1LTmh+aPUdwMxWkN4kSNP6Zj+F5DEhSzrrWaz QtC0wMPlrCc+8FBgK86KXw17RSlW84Y17aEngYhdlPVXJnZIf14A004V5hs4WR9bg4BN 1lGg== X-Gm-Message-State: AOJu0Yy5n/GrRDQqb2Gz9wyB4VzEl/zWSPgELstJgghDW9j7p2MKunmm nizUEAFXOVKhxtNY9zQuWI/fZPtYZW4= X-Google-Smtp-Source: AGHT+IGGcxVYGAYGv3uCrE8wHX1TR4p8IURd9gUNgfJNwa+fo9vdIR8HGGPD/6eLST5HVrX+Zf4WM1nECms= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6a00:1755:b0:68e:24fe:d9a with SMTP id j21-20020a056a00175500b0068e24fe0d9amr205380pfc.2.1698703932137; Mon, 30 Oct 2023 15:12:12 -0700 (PDT) Date: Mon, 30 Oct 2023 15:12:10 -0700 In-Reply-To: Mime-Version: 1.0 References: <20231027182217.3615211-1-seanjc@google.com> <20231027182217.3615211-9-seanjc@google.com> <211d093f-4023-4a39-a23f-6d8543512675@redhat.com> Message-ID: Subject: Re: [PATCH v13 08/35] KVM: Introduce KVM_SET_USER_MEMORY_REGION2 From: Sean Christopherson To: Paolo Bonzini Cc: Marc Zyngier , Oliver Upton , Huacai Chen , Michael Ellerman , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexander Viro , Christian Brauner , "Matthew Wilcox (Oracle)" , Andrew Morton , kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-mips@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Xiaoyao Li , Xu Yilun , Chao Peng , Fuad Tabba , Jarkko Sakkinen , Anish Moorthy , David Matlack , Yu Zhang , Isaku Yamahata , "=?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?=" , Vlastimil Babka , Vishal Annapurve , Ackerley Tng , Maciej Szmigiero , David Hildenbrand , Quentin Perret , Michael Roth , Wang , Liam Merwick , Isaku Yamahata , "Kirill A . Shutemov" X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231030_151213_898004_82BF89D4 X-CRM114-Status: GOOD ( 16.24 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org On Mon, Oct 30, 2023, Sean Christopherson wrote: > On Mon, Oct 30, 2023, Paolo Bonzini wrote: > > On 10/27/23 20:21, Sean Christopherson wrote: > > > > > > + if (ioctl == KVM_SET_USER_MEMORY_REGION) > > > + size = sizeof(struct kvm_userspace_memory_region); > > > > This also needs a memset(&mem, 0, sizeof(mem)), otherwise the out-of-bounds > > access of the commit message becomes a kernel stack read. > > Ouch. There's some irony. Might be worth doing memset(&mem, -1, sizeof(mem)) > though as '0' is a valid file descriptor and a valid file offset. > > > Probably worth adding a check on valid flags here. > > Definitely needed. There's a very real bug here. But rather than duplicate flags > checking or plumb @ioctl all the way to __kvm_set_memory_region(), now that we > have the fancy guard(mutex) and there are no internal calls to kvm_set_memory_region(), > what if we: > > 1. Acquire/release slots_lock in __kvm_set_memory_region() Gah, this won't work with x86's usage, which acquire slots_lock quite far away from __kvm_set_memory_region() in several places. The rest of the idea still works, kvm_vm_ioctl_set_memory_region() will just need to take slots_lock manually. > 2. Call kvm_set_memory_region() from x86 code for the internal memslots > 3. Disallow *any* flags for internal memslots > 4. Open code check_memory_region_flags in kvm_vm_ioctl_set_memory_region() > 5. Pass @ioctl to kvm_vm_ioctl_set_memory_region() and allow KVM_MEM_PRIVATE > only for KVM_SET_USER_MEMORY_REGION2 _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 435E6C4332F for ; Mon, 30 Oct 2023 22:13:07 +0000 (UTC) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20230601 header.b=bvATlgQ1; dkim-atps=neutral Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4SK6wK6JdVz3cYj for ; Tue, 31 Oct 2023 09:13:05 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20230601 header.b=bvATlgQ1; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=flex--seanjc.bounces.google.com (client-ip=2607:f8b0:4864:20::44a; helo=mail-pf1-x44a.google.com; envelope-from=3pcpazqykdmezlhuqjnvvnsl.jvtspu14wwj-kl2spz0z.v6shiz.vyn@flex--seanjc.bounces.google.com; receiver=lists.ozlabs.org) Received: from mail-pf1-x44a.google.com (mail-pf1-x44a.google.com [IPv6:2607:f8b0:4864:20::44a]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4SK6vP0nrTz2yG9 for ; Tue, 31 Oct 2023 09:12:15 +1100 (AEDT) Received: by mail-pf1-x44a.google.com with SMTP id d2e1a72fcca58-6b9af7d4168so5053828b3a.1 for ; Mon, 30 Oct 2023 15:12:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1698703932; x=1699308732; darn=lists.ozlabs.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=g8DEvtikhnQyn+T5K55cZjm1cs6/IKtx/WCyiBBil5U=; b=bvATlgQ1kJTnF3vtIECyuyLvWf4w3Fw8KD3DzjmokIn/KQuXNkRtFxs5YSBT7R25nb cY/Fn5iyHwQY9lMaXtjkL6jI5q09nOXIcJJIura9mu8M27NgL/5nrn7X9pzFKfm2mKKD jwVZlG4SJETzxLszhUNT9XZgsjfySiMuQHLB5wWaM5Jei7cgVML/IiGUbgCJ+ZNZUVzS BvlTHkyXAJ30acxGXWND/nrFddFfHsKG1vp212J39fL12HsFmIvBqVFlYj7olepMYO1R pIOJN8rIaI8bG6ONja7A7QAhfeY1eqVGxTgZXPMDicmpC4BfpE/Al6ZzjgV3vG85A0UI +CKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1698703932; x=1699308732; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=g8DEvtikhnQyn+T5K55cZjm1cs6/IKtx/WCyiBBil5U=; b=s608pc0vtzW0RlsERuHozvrLreixulh5SFJudzH222ISkEpwW4JBRT7+AoOD04LRHZ 3jlbREuiY5Hdyt9q/fXLFMSktuYRHVzcmNUhyjP0aUjFTWu9sCGj4AJk2bxRZVpCtfOh DhuIaGhC3Y8EBVNwFplwFEnb7jn95XieppBm7k+uzM4+TRCMiDFzrF6XU5GCNVYawt6v G4maRRiVQjUjbIlQdmGg9OOhxQfLBz2dcYpp9FLMewJUxJRj2mWneetTsNTbWpAu98S6 68L7vsTDBnK0D5LIHy+ajAmqlNm0xfQ/1FHKxb8XsPay+FY5CpqgT3TKfukrgiQccyAN dRcA== X-Gm-Message-State: AOJu0YxmOOU+ouOyNHoolMg1XRckP2U3NM8PnONI0j04jGmaepWX7grl nT8GP9FM43E3TIaCKU2uTd8hLbtMjKI= X-Google-Smtp-Source: AGHT+IGGcxVYGAYGv3uCrE8wHX1TR4p8IURd9gUNgfJNwa+fo9vdIR8HGGPD/6eLST5HVrX+Zf4WM1nECms= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6a00:1755:b0:68e:24fe:d9a with SMTP id j21-20020a056a00175500b0068e24fe0d9amr205380pfc.2.1698703932137; Mon, 30 Oct 2023 15:12:12 -0700 (PDT) Date: Mon, 30 Oct 2023 15:12:10 -0700 In-Reply-To: Mime-Version: 1.0 References: <20231027182217.3615211-1-seanjc@google.com> <20231027182217.3615211-9-seanjc@google.com> <211d093f-4023-4a39-a23f-6d8543512675@redhat.com> Message-ID: Subject: Re: [PATCH v13 08/35] KVM: Introduce KVM_SET_USER_MEMORY_REGION2 From: Sean Christopherson To: Paolo Bonzini Content-Type: text/plain; charset="us-ascii" X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kvm@vger.kernel.org, David Hildenbrand , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Chao Peng , linux-riscv@lists.infradead.org, Isaku Yamahata , Marc Zyngier , Huacai Chen , Xiaoyao Li , "Matthew Wilcox \(Oracle\)" , Wang , Fuad Tabba , Yu Zhang , Maciej Szmigiero , Albert Ou , Vlastimil Babka , Michael Roth , Ackerley Tng , Alexander Viro , Paul Walmsley , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= , Isaku Yamahata , Christian Brauner , Quentin Perret , l inux-mips@vger.kernel.org, Oliver Upton , David Matlack , Jarkko Sakkinen , Palmer Dabbelt , "Kirill A . Shutemov" , kvm-riscv@lists.infradead.org, Anup Patel , linux-fsdevel@vger.kernel.org, Liam Merwick , Andrew Morton , Vishal Annapurve , linuxppc-dev@lists.ozlabs.org, Xu Yilun , Anish Moorthy Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Sender: "Linuxppc-dev" On Mon, Oct 30, 2023, Sean Christopherson wrote: > On Mon, Oct 30, 2023, Paolo Bonzini wrote: > > On 10/27/23 20:21, Sean Christopherson wrote: > > > > > > + if (ioctl == KVM_SET_USER_MEMORY_REGION) > > > + size = sizeof(struct kvm_userspace_memory_region); > > > > This also needs a memset(&mem, 0, sizeof(mem)), otherwise the out-of-bounds > > access of the commit message becomes a kernel stack read. > > Ouch. There's some irony. Might be worth doing memset(&mem, -1, sizeof(mem)) > though as '0' is a valid file descriptor and a valid file offset. > > > Probably worth adding a check on valid flags here. > > Definitely needed. There's a very real bug here. But rather than duplicate flags > checking or plumb @ioctl all the way to __kvm_set_memory_region(), now that we > have the fancy guard(mutex) and there are no internal calls to kvm_set_memory_region(), > what if we: > > 1. Acquire/release slots_lock in __kvm_set_memory_region() Gah, this won't work with x86's usage, which acquire slots_lock quite far away from __kvm_set_memory_region() in several places. The rest of the idea still works, kvm_vm_ioctl_set_memory_region() will just need to take slots_lock manually. > 2. Call kvm_set_memory_region() from x86 code for the internal memslots > 3. Disallow *any* flags for internal memslots > 4. Open code check_memory_region_flags in kvm_vm_ioctl_set_memory_region() > 5. Pass @ioctl to kvm_vm_ioctl_set_memory_region() and allow KVM_MEM_PRIVATE > only for KVM_SET_USER_MEMORY_REGION2 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7E989C4332F for ; Mon, 30 Oct 2023 22:12:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID: References:Mime-Version:In-Reply-To:Date:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=UX1nE8YgyaoPZp2IfJaKzoQWkaZF2jde7Kw2RwnmZlI=; b=SC91l6ik0iiKGGObb9YU7xOTir 9NvXNsOehq5qN+PaJiv4IeyP9oOhlGjk0rCfXyBiJrnV/3Vs2GuM4EesfZ8Q6c+AWyH45d3ThEOkv STCJLcoozpNl+wrMCf013GgCDjijw5pc1oicb3R2YRw4soZrLMCI73tgECCeRHIPwiBHfRDpsEHXQ D/LUVIlTnCxXHlPeXGIw6wU0EuVQQjqFTQ+BP7VLs4kXOKXlVWZgCo5tuXdgaCxSSk04YbyVR9Hfu +2ueFQJ8S4QfrQUZ3oWYaNF+GkEvX9yHINPymvS/TZG/QIVtoMvS+jxqhO7Gxkg8SaACYjK/qVXmK DDfPJBNQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qxaUb-0047f8-1g; Mon, 30 Oct 2023 22:12:17 +0000 Received: from mail-pf1-x44a.google.com ([2607:f8b0:4864:20::44a]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qxaUX-0047d7-35 for linux-arm-kernel@lists.infradead.org; Mon, 30 Oct 2023 22:12:15 +0000 Received: by mail-pf1-x44a.google.com with SMTP id d2e1a72fcca58-6be1065cc81so5043798b3a.3 for ; Mon, 30 Oct 2023 15:12:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1698703932; x=1699308732; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=g8DEvtikhnQyn+T5K55cZjm1cs6/IKtx/WCyiBBil5U=; b=F/siSCEIdYnFxGTDeSbz/y5gnYv4X51buZ9WzLV9O0LAUBVDkxXXYS1THKF6HlsxSv QG1IsiUiE4zzQ04R1cMT0Ib7grVRuC8E6ciSsypgaHoPAdLH53Za1LCF54piEqfgGF/4 s+VMxb0FawY3UvE7lvhrdrTj6HFcmxxdvueHeokG2b60qifwYZ3KbqvoCz2CZccGSU49 n898xozT6+vJsHAGvopQseuBjSwXApfdPGtb0R+Ax6XKX0esq3eTbd240AnKxXwchMRJ oQ7+7yNMChcdQF7WnadPdVE28b5RcQ91XrEeZvRvw1a5HA/+eBHqxvyBtLtvDvuW82T2 6X3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1698703932; x=1699308732; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=g8DEvtikhnQyn+T5K55cZjm1cs6/IKtx/WCyiBBil5U=; b=sAxpvmD6OgxU6zNLBg+XA/xZY4ULbKq2oUQLZaBDTiDojpCqdRIDseGp8I+7lncjI/ ZCMRt1M7wv6q9xAIYMZzuPGydXBDYJVwEVqLVeTqB7EanIz+iB1hd54LyODtwvkohNlD UW+MWM70928WQ+sGmhmARpRidaTE+rzAEEmodXa++SvmWGf0fI7D9lmT022bIt4bHu6r pjjSqgTMbJbK/BlXbPKDcnj4GeyWLvCi8PSeeZp7tapd6gKgf4C4YwqzDtM06ScC6HdT QM4paLnTGWACr7ZvKcyRmCeqENmd737Mbrg5w4SHhBgiCRDKcD8ZWcy6IPAdgIH00NMg 065Q== X-Gm-Message-State: AOJu0YzxdVOL15ueE5Q+co8MimuV7TRONne+oQ3mjo0LENgXA8l3yMyX Ouu9kG+yjPTkwkPMmyqGUG4l2xdEtNU= X-Google-Smtp-Source: AGHT+IGGcxVYGAYGv3uCrE8wHX1TR4p8IURd9gUNgfJNwa+fo9vdIR8HGGPD/6eLST5HVrX+Zf4WM1nECms= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6a00:1755:b0:68e:24fe:d9a with SMTP id j21-20020a056a00175500b0068e24fe0d9amr205380pfc.2.1698703932137; Mon, 30 Oct 2023 15:12:12 -0700 (PDT) Date: Mon, 30 Oct 2023 15:12:10 -0700 In-Reply-To: Mime-Version: 1.0 References: <20231027182217.3615211-1-seanjc@google.com> <20231027182217.3615211-9-seanjc@google.com> <211d093f-4023-4a39-a23f-6d8543512675@redhat.com> Message-ID: Subject: Re: [PATCH v13 08/35] KVM: Introduce KVM_SET_USER_MEMORY_REGION2 From: Sean Christopherson To: Paolo Bonzini Cc: Marc Zyngier , Oliver Upton , Huacai Chen , Michael Ellerman , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexander Viro , Christian Brauner , "Matthew Wilcox (Oracle)" , Andrew Morton , kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-mips@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Xiaoyao Li , Xu Yilun , Chao Peng , Fuad Tabba , Jarkko Sakkinen , Anish Moorthy , David Matlack , Yu Zhang , Isaku Yamahata , "=?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?=" , Vlastimil Babka , Vishal Annapurve , Ackerley Tng , Maciej Szmigiero , David Hildenbrand , Quentin Perret , Michael Roth , Wang , Liam Merwick , Isaku Yamahata , "Kirill A . Shutemov" X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231030_151213_997305_3EBA0497 X-CRM114-Status: GOOD ( 17.77 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Oct 30, 2023, Sean Christopherson wrote: > On Mon, Oct 30, 2023, Paolo Bonzini wrote: > > On 10/27/23 20:21, Sean Christopherson wrote: > > > > > > + if (ioctl == KVM_SET_USER_MEMORY_REGION) > > > + size = sizeof(struct kvm_userspace_memory_region); > > > > This also needs a memset(&mem, 0, sizeof(mem)), otherwise the out-of-bounds > > access of the commit message becomes a kernel stack read. > > Ouch. There's some irony. Might be worth doing memset(&mem, -1, sizeof(mem)) > though as '0' is a valid file descriptor and a valid file offset. > > > Probably worth adding a check on valid flags here. > > Definitely needed. There's a very real bug here. But rather than duplicate flags > checking or plumb @ioctl all the way to __kvm_set_memory_region(), now that we > have the fancy guard(mutex) and there are no internal calls to kvm_set_memory_region(), > what if we: > > 1. Acquire/release slots_lock in __kvm_set_memory_region() Gah, this won't work with x86's usage, which acquire slots_lock quite far away from __kvm_set_memory_region() in several places. The rest of the idea still works, kvm_vm_ioctl_set_memory_region() will just need to take slots_lock manually. > 2. Call kvm_set_memory_region() from x86 code for the internal memslots > 3. Disallow *any* flags for internal memslots > 4. Open code check_memory_region_flags in kvm_vm_ioctl_set_memory_region() > 5. Pass @ioctl to kvm_vm_ioctl_set_memory_region() and allow KVM_MEM_PRIVATE > only for KVM_SET_USER_MEMORY_REGION2 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel