Re: [PATCH] Check for ambiguities in create alias ioctl.

Re: [PATCH] Check for ambiguities in create alias ioctl.

[Avi Kivity]

Glauber Costa wrote:
> The current alias ioctl allows for the creation of
> an alias covering a gpa that already exists. It is invalid,
> because the gpa space needs to be uniquely mapped. So, if
> there's a memory slot covering gpa range 0x123000 to 0x124000,
> and we create an alias from any gpa within that range to a different
> target, we create an essential ambiguity that brings no value at
> the cost of a lot of confusion. Right now this confusion
> manifests itself as a BUG() triggered in the rmaps code path.
>   

> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 7a2aeba..c3b5770 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -1591,6 +1591,8 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
>  {
>  	int r, n;
>  	struct kvm_mem_alias *p;
> +	gfn_t base_gfn;
> +	unsigned long npages;
>  
>  	r = -EINVAL;
>  	/* General sanity checks */
> @@ -1607,12 +1609,18 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
>  	    < alias->target_phys_addr)
>  		goto out;
>  
> +	base_gfn = alias->guest_phys_addr >> PAGE_SHIFT;
> +	npages = alias->memory_size >> PAGE_SHIFT;
> +
> +	if (gfn_to_memslot(kvm, base_gfn) || gfn_to_memslot(kvm, base_gfn + npages))
> +		goto out;
> +
>   

This says nothing about base_gfn + 17.  Moreover, we don't care if 
base+gfn +npages is mapped - it's outside the half-closed alias range.

Further, a clever attacker would first establish the alias, then the 
memslot, bypassing the checks.  I suggest (a) extracting a function to 
check for range overlap from the memslot code, (b) extending it to check 
for both memslots and aliases, and (c) using it everywhere.

-- 
error compiling committee.c: too many arguments to function

[PATCH] Check for ambiguities in create alias ioctl.

[Glauber Costa]

The current alias ioctl allows for the creation of
an alias covering a gpa that already exists. It is invalid,
because the gpa space needs to be uniquely mapped. So, if
there's a memory slot covering gpa range 0x123000 to 0x124000,
and we create an alias from any gpa within that range to a different
target, we create an essential ambiguity that brings no value at
the cost of a lot of confusion. Right now this confusion
manifests itself as a BUG() triggered in the rmaps code path.

Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 arch/x86/kvm/x86.c |   12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 7a2aeba..c3b5770 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1591,6 +1591,8 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
 {
 	int r, n;
 	struct kvm_mem_alias *p;
+	gfn_t base_gfn;
+	unsigned long npages;
 
 	r = -EINVAL;
 	/* General sanity checks */
@@ -1607,12 +1609,18 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
 	    < alias->target_phys_addr)
 		goto out;
 
+	base_gfn = alias->guest_phys_addr >> PAGE_SHIFT;
+	npages = alias->memory_size >> PAGE_SHIFT;
+
+	if (gfn_to_memslot(kvm, base_gfn) || gfn_to_memslot(kvm, base_gfn + npages))
+		goto out;
+
 	down_write(&kvm->slots_lock);
 	spin_lock(&kvm->mmu_lock);
 
 	p = &kvm->arch.aliases[alias->slot];
-	p->base_gfn = alias->guest_phys_addr >> PAGE_SHIFT;
-	p->npages = alias->memory_size >> PAGE_SHIFT;
+	p->base_gfn = base_gfn;
+	p->npages = npages;
 	p->target_gfn = alias->target_phys_addr >> PAGE_SHIFT;
 
 	for (n = KVM_ALIAS_SLOTS; n > 0; --n)
-- 
1.5.6.5

[PATCH] Check for ambiguities in create alias ioctl.

[Glauber Costa]

The current alias ioctl allows for the creation of
an alias covering a gpa that already exists. It is invalid,
because the gpa space needs to be uniquely mapped. So, if
there's a memory slot covering gpa range 0x123000 to 0x124000,
and we create an alias from any gpa within that range to a different
target, we create an essential ambiguity that brings no value at
the cost of a lot of confusion. Right now this confusion
manifests itself as a BUG() triggered in the rmaps code path.

Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 arch/ia64/kvm/kvm-ia64.c   |    6 ++++++
 arch/powerpc/kvm/powerpc.c |    5 +++++
 arch/s390/kvm/kvm-s390.c   |    6 ++++++
 arch/x86/kvm/x86.c         |   23 +++++++++++++++++++++--
 include/linux/kvm_host.h   |    4 ++++
 virt/kvm/kvm_main.c        |   31 ++++++++++++++++++++-----------
 6 files changed, 62 insertions(+), 13 deletions(-)

diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index af1464f..7e9d796 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -1695,6 +1695,12 @@ void kvm_arch_hardware_unsetup(void)
 {
 }
 
+int kvm_arch_check_overlap(struct kvm *kvm, gfn_t base_gfn,
+			   unsigned long npages, void *me)
+{
+	return 0;
+}
+
 static void vcpu_kick_intr(void *info)
 {
 #ifdef DEBUG
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index 90a6fc4..a0c164e 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -45,6 +45,11 @@ int kvm_arch_vcpu_runnable(struct kvm_vcpu *v)
 	return !(v->arch.msr & MSR_WE);
 }
 
+int kvm_arch_check_overlap(struct kvm *kvm, gfn_t base_gfn,
+			   unsigned long npages, void *me)
+{
+	return 0;
+}
 
 int kvmppc_emulate_mmio(struct kvm_run *run, struct kvm_vcpu *vcpu)
 {
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 8b00eb2..780f33e 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -101,6 +101,12 @@ void kvm_arch_exit(void)
 {
 }
 
+int kvm_arch_check_overlap(struct kvm *kvm, gfn_t base_gfn,
+			   unsigned long npages, void *me)
+{
+	return 0;
+}
+
 /* Section: device related */
 long kvm_arch_dev_ioctl(struct file *filp,
 			unsigned int ioctl, unsigned long arg)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index f1f8ff2..324af5e 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1506,6 +1506,22 @@ gfn_t unalias_gfn(struct kvm *kvm, gfn_t gfn)
 	return gfn;
 }
 
+int kvm_arch_check_overlap(struct kvm *kvm, gfn_t base_gfn,
+			 unsigned long npages, void *me)
+{
+	int i;
+	for (i = 0; i <	kvm->arch.naliases ; i++) {
+		struct kvm_mem_alias *p = &kvm->arch.aliases[i];
+		if (p == me)
+			continue;
+
+		if (!((base_gfn + npages < p->base_gfn) ||
+                      (base_gfn > p->base_gfn + p->npages)))
+			return -EEXIST;
+	}
+	return 0;
+}
+
 /*
  * Set a new alias region.  Aliases map a portion of physical memory into
  * another portion.  This is useful for memory windows, for example the PC
@@ -1540,18 +1556,21 @@ static int kvm_vm_ioctl_set_memory_alias(struct kvm *kvm,
 	p->npages = alias->memory_size >> PAGE_SHIFT;
 	p->target_gfn = alias->target_phys_addr >> PAGE_SHIFT;
 
+	r = kvm_check_overlap(kvm, p->base_gfn, p->npages, p);
+	if (r)
+		goto out_locked;
+
 	for (n = KVM_ALIAS_SLOTS; n > 0; --n)
 		if (kvm->arch.aliases[n - 1].npages)
 			break;
 	kvm->arch.naliases = n;
 
+out_locked:
 	spin_unlock(&kvm->mmu_lock);
 	kvm_mmu_zap_all(kvm);
 
 	up_write(&kvm->slots_lock);
 
-	return 0;
-
 out:
 	return r;
 }
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index bb92be2..79f34ab 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -178,6 +178,10 @@ int kvm_arch_set_memory_region(struct kvm *kvm,
 				struct kvm_userspace_memory_region *mem,
 				struct kvm_memory_slot old,
 				int user_alloc);
+int kvm_check_overlap(struct kvm *kvm, gfn_t base_gfn,
+			  unsigned long pages, void *me);
+int kvm_arch_check_overlap(struct kvm *kvm, gfn_t base_gfn,
+			  unsigned long pages, void *me);
 void kvm_arch_flush_shadow(struct kvm *kvm);
 gfn_t unalias_gfn(struct kvm *kvm, gfn_t gfn);
 struct page *gfn_to_page(struct kvm *kvm, gfn_t gfn);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index fd265b2..18af322 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -685,6 +685,23 @@ static int kvm_vm_release(struct inode *inode, struct file *filp)
 	return 0;
 }
 
+int kvm_check_overlap(struct kvm *kvm, gfn_t base_gfn,
+		      unsigned long npages, void *me)
+{
+	int i;
+	
+	for (i = 0; i < KVM_MEMORY_SLOTS; ++i) {
+		struct kvm_memory_slot *s = &kvm->memslots[i];
+
+		if (s == me)
+			continue;
+		if (!((base_gfn + npages <= s->base_gfn) ||
+		      (base_gfn >= s->base_gfn + s->npages)))
+			return -EEXIST;
+	}
+	return kvm_arch_check_overlap(kvm, base_gfn, npages, me);
+}
+
 /*
  * Allocate some memory and give it an address in the guest physical address
  * space.
@@ -700,7 +717,6 @@ int __kvm_set_memory_region(struct kvm *kvm,
 	int r;
 	gfn_t base_gfn;
 	unsigned long npages;
-	unsigned long i;
 	struct kvm_memory_slot *memslot;
 	struct kvm_memory_slot old, new;
 
@@ -733,17 +749,10 @@ int __kvm_set_memory_region(struct kvm *kvm,
 	if (npages && old.npages && npages != old.npages)
 		goto out_free;
 
-	/* Check for overlaps */
-	r = -EEXIST;
-	for (i = 0; i < KVM_MEMORY_SLOTS; ++i) {
-		struct kvm_memory_slot *s = &kvm->memslots[i];
+	r = kvm_check_overlap(kvm, base_gfn, npages, memslot);
+	if (r)
+		goto out_free;
 
-		if (s == memslot)
-			continue;
-		if (!((base_gfn + npages <= s->base_gfn) ||
-		      (base_gfn >= s->base_gfn + s->npages)))
-			goto out_free;
-	}
 
 	/* Free page dirty bitmap if unneeded */
 	if (!(new.flags & KVM_MEM_LOG_DIRTY_PAGES))
-- 
1.5.6.5