From mboxrd@z Thu Jan  1 00:00:00 1970
From: bugzilla-daemon@bugzilla.kernel.org
Subject: [Bug 103131] New: Forgotten stack pushes with KVM_MEM_READONLY
Date: Wed, 19 Aug 2015 14:12:10 +0000
Message-ID: <bug-103131-28872@https.bugzilla.kernel.org/>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
To: kvm@vger.kernel.org
Return-path: <kvm-owner@vger.kernel.org>
Received: from mail.kernel.org ([198.145.29.136]:36194 "EHLO mail.kernel.org"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1753418AbbHSOMP (ORCPT <rfc822;kvm@vger.kernel.org>);
	Wed, 19 Aug 2015 10:12:15 -0400
Received: from mail.kernel.org (localhost [127.0.0.1])
	by mail.kernel.org (Postfix) with ESMTP id 4DC81207C7
	for <kvm@vger.kernel.org>; Wed, 19 Aug 2015 14:12:13 +0000 (UTC)
Received: from bugzilla2.web.kernel.org (bugzilla2.web.kernel.org [172.20.200.52])
	by mail.kernel.org (Postfix) with ESMTP id D954B207CF
	for <kvm@vger.kernel.org>; Wed, 19 Aug 2015 14:12:10 +0000 (UTC)
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

https://bugzilla.kernel.org/show_bug.cgi?id=103131

            Bug ID: 103131
           Summary: Forgotten stack pushes with KVM_MEM_READONLY
           Product: Virtualization
           Version: unspecified
    Kernel Version: 4.1.5
          Hardware: x86-64
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: kvm
          Assignee: virtualization_kvm@kernel-bugs.osdl.org
          Reporter: felix.von.s@posteo.de
        Regression: No

Created attachment 185201
  --> https://bugzilla.kernel.org/attachment.cgi?id=185201&action=edit
Test program (C99)

I found this bug when I wanted to use KVM_MEM_READONLY to capture all memory
writes in my hypervisor.

Attached test program output when ran with the argument "0" (no flags):

> vm exit from f000:0000f006 [cs base 0x000f0000, pc=0x000ff006]
> io: out 2 bytes x1 @0xbeef: fa 7f
> vm exit from f000:0000fffb [cs base 0x000f0000, pc=0x000ffffb]
> halted

Output when ran with "2" (KVM_MEM_READONLY):

> vm exit from f000:0000f000 [cs base 0x000f0000, pc=0x000ff000]
> write 2 bytes at 0x7ffa: fa ff 00 00 00 00 00 00
> vm exit from f000:0000f006 [cs base 0x000f0000, pc=0x000ff006]
> io: out 2 bytes x1 @0xbeef: fa 7f
> vm exit from f4f4:0000fffa [cs base 0x000f4f40, pc=0x00104f3a]
> internal error, suberror 0x1

In real mode, doing an INT call is roughly equivalent to pushing the flags
register, CS, IP and then jumping to the appropriate handler listed in the IVT.
As you can see from above, when KVM_MEM_READONLY flag is set, only the "pushing
IP" part is captured by the hypervisor; the other memory writes are forgotten
(although the stack pointer is updated accordingly). This causes a later IRET
to return to the wrong segment (never mind with the wrong flags) and the
virtual machine to crash.

I don't know if there are any security implications; I quite doubt it to be
honest, but if anyone wants to design a cutesy logo, please do.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.