From mboxrd@z Thu Jan  1 00:00:00 1970
From: Avi Kivity <avi@redhat.com>
Subject: Re: KVM: x86: check for cr3 validity in ioctl_set_sregs
Date: Thu, 16 Apr 2009 15:42:59 +0300
Message-ID: <49E727D3.8050306@redhat.com>
References: <20090415221042.GA20127@amt.cnet> <49E6F2AF.9050300@redhat.com> <20090416091042.GA6709@amt.cnet> <49E6F92C.2000202@redhat.com> <20090416113044.GA11200@amt.cnet>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: kvm <kvm@vger.kernel.org>
To: Marcelo Tosatti <mtosatti@redhat.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx2.redhat.com ([66.187.237.31]:44689 "EHLO mx2.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1753689AbZDPMnI (ORCPT <rfc822;kvm@vger.kernel.org>);
	Thu, 16 Apr 2009 08:43:08 -0400
Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26])
	by mx2.redhat.com (8.13.8/8.13.8) with ESMTP id n3GCh6jR031018
	for <kvm@vger.kernel.org>; Thu, 16 Apr 2009 08:43:06 -0400
In-Reply-To: <20090416113044.GA11200@amt.cnet>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

Marcelo Tosatti wrote:
> Matt T. Yourst notes that kvm_arch_vcpu_ioctl_set_sregs lacks validity
> checking for the new cr3 value:
>       
> "Userspace callers of KVM_SET_SREGS can pass a bogus value of cr3 to
> the kernel. This will trigger a NULL pointer access in gfn_to_rmap()
> when userspace next tries to call KVM_RUN on the affected VCPU and kvm
> attempts to activate the new non-existent page table root.
>
> This happens since kvm only validates that cr3 points to a valid guest
> physical memory page when code *inside* the guest sets cr3. However, kvm
> currently trusts the userspace caller (e.g. QEMU) on the host machine to
> always supply a valid page table root, rather than properly validating
> it along with the rest of the reloaded guest state."
>
> http://sourceforge.net/tracker/?func=detail&atid=893831&aid=2687641&group_id=180599
>
> Check for a valid cr3 address in kvm_arch_vcpu_ioctl_set_sregs, triple
> fault in case of failure.
>
> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
>
> Index: kvm/arch/x86/kvm/x86.c
> ===================================================================
> --- kvm.orig/arch/x86/kvm/x86.c
> +++ kvm/arch/x86/kvm/x86.c
> @@ -3986,7 +3986,13 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct
>  
>  	vcpu->arch.cr2 = sregs->cr2;
>  	mmu_reset_needed |= vcpu->arch.cr3 != sregs->cr3;
> -	vcpu->arch.cr3 = sregs->cr3;
> +
> +	down_read(&vcpu->kvm->slots_lock);
> +	if (gfn_to_memslot(vcpu->kvm, sregs->cr3 >> PAGE_SHIFT))
> +		vcpu->arch.cr3 = sregs->cr3;
> +	else
> +		set_bit(KVM_REQ_TRIPLE_FAULT, &vcpu->requests);
> +	up_read(&vcpu->kvm->slots_lock);
>  
>  	kvm_set_cr8(vcpu, sregs->cr8);
>  
>   

Isn't this self-defeating?  If you drop slots_lock, cr3 may be invalid 
again by the time you set cvpu->arch.cr3?


-- 
Do not meddle in the internals of kernels, for they are subtle and quick to panic.