From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cornelia Huck Subject: Re: [PATCH v3] KVM: remove buggy vcpu id check on vcpu creation Date: Wed, 20 Apr 2016 18:48:07 +0200 Message-ID: <20160420184807.056da314.cornelia.huck@de.ibm.com> References: <146116689259.20666.15860134511726195550.stgit@bahia.huguette.org> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: Paolo Bonzini , james.hogan@imgtec.com, mingo@redhat.com, linux-mips@linux-mips.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, qemu-ppc@nongnu.org, Paul Mackerras , David Gibson To: Greg Kurz Return-path: Received: from e06smtp08.uk.ibm.com ([195.75.94.104]:45753 "EHLO e06smtp08.uk.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750749AbcDTQsY (ORCPT ); Wed, 20 Apr 2016 12:48:24 -0400 Received: from localhost by e06smtp08.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 20 Apr 2016 17:48:22 +0100 In-Reply-To: <146116689259.20666.15860134511726195550.stgit@bahia.huguette.org> Sender: kvm-owner@vger.kernel.org List-ID: On Wed, 20 Apr 2016 17:44:54 +0200 Greg Kurz wrote: > Commit 338c7dbadd26 ("KVM: Improve create VCPU parameter (CVE-2013-4587)") > introduced a check to prevent potential kernel memory corruption in case > the vcpu id is too great. > > Unfortunately this check assumes vcpu ids grow in sequence with a common > difference of 1, which is wrong: archs are free to use vcpu id as they fit. > For example, QEMU originated vcpu ids for PowerPC cpus running in boot3s_hv > mode, can grow with a common difference of 2, 4 or 8: if KVM_MAX_VCPUS is > 1024, guests may be limited down to 128 vcpus on POWER8. > > This means the check does not belong here and should be moved to some arch > specific function: kvm_arch_vcpu_create() looks like a good candidate. > > ARM and s390 already have such a check. > > I could not spot any path in the PowerPC or common KVM code where a vcpu > id is used as described in the above commit: I believe PowerPC can live > without this check. > > In the end, this patch simply moves the check to MIPS and x86. > > Signed-off-by: Greg Kurz > --- > v3: use ERR_PTR() > > arch/mips/kvm/mips.c | 7 ++++++- > arch/x86/kvm/x86.c | 3 +++ > virt/kvm/kvm_main.c | 3 --- > 3 files changed, 9 insertions(+), 4 deletions(-) > Acked-by: Cornelia Huck