From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF44EC4320A for ; Wed, 1 Sep 2021 08:27:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C60146103D for ; Wed, 1 Sep 2021 08:27:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243147AbhIAI2T (ORCPT ); Wed, 1 Sep 2021 04:28:19 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]:44546 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232792AbhIAI2S (ORCPT ); Wed, 1 Sep 2021 04:28:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1630484839; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ovcjyG7IDaOy6ifWW+v+m6prcD2wZaK5/tKOHaPCRA8=; b=HgJJqzg2OBdcKqXX7FOkcNExTFCpactQB3NctE7Wl+wLtLEfheEPW8+F6urTaYiV4ffOKv c+nJtKZAJfExOBtoef+q+Uice04n1LKd0rmSfMwEp4yNc83UKpYA0xEQZXwwisIA21EmuD 7nfPi7nP/gpvAxmTwmZYQ65VCiYBzEQ= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-408-rfxIcQGiMRyA7IfMZ6NyPQ-1; Wed, 01 Sep 2021 04:27:18 -0400 X-MC-Unique: rfxIcQGiMRyA7IfMZ6NyPQ-1 Received: by mail-wm1-f69.google.com with SMTP id f19-20020a1c1f13000000b002e6bd83c344so744637wmf.3 for ; Wed, 01 Sep 2021 01:27:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:in-reply-to:references:date :message-id:mime-version; bh=ovcjyG7IDaOy6ifWW+v+m6prcD2wZaK5/tKOHaPCRA8=; b=jCRWTn/fzH0bZ+TnCvUQnuGH1NH2RoxvwHKCOR8qG6/TeREXeM61BOgzcHvoIRZsqK 1Z7Av98dDc5lT5WZMFl+qIG+hio6nQuusxrKtmuUeQeGzrbJCRcJ2pIbDpQGNjUaXpNq m3/GNUSjaZI81PinNKo9gJRYdJBJGgnwGtcNoDg6AQe71BM3cAd7MYiNgdApB7H7+dZ9 DOiE7IEo9yMB06n5eCcSBcmsM4Hcm+O/ckKoxuuJeEttw3Zs6iwJgoOZI1EczKR7EjgU AqzpmSdI++jmpwQWoFdK9RikBqTuX/gH8ZdyEViYJhkEw4Uwut8d3lj6fAqnU9bwaw1/ LIvw== X-Gm-Message-State: AOAM531x3BDacUBOu9/BX2e7PIFM45ilL9BIdz6H2wQTxpwk/uVloxUT qCsF0erNI8UaGPDIlfHXqu1OAnW7iGxfk2VdtHr9wVKjVXxOupQlMbwLD1CGW9S1xhCiBCXpUge Baosrn2YoJV2PIV8OD1/8168+ X-Received: by 2002:a7b:c4cb:: with SMTP id g11mr8411413wmk.80.1630484836986; Wed, 01 Sep 2021 01:27:16 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwVHVGo8/2yaFqDLnkSXohfmFINaCXjLS/UevTrlJwzmeSr3ztn2rVI0RS4UIxlE57pxWngTg== X-Received: by 2002:a7b:c4cb:: with SMTP id g11mr8411397wmk.80.1630484836753; Wed, 01 Sep 2021 01:27:16 -0700 (PDT) Received: from vitty.brq.redhat.com (g-server-2.ign.cz. [91.219.240.2]) by smtp.gmail.com with ESMTPSA id u5sm20249739wrr.94.2021.09.01.01.27.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Sep 2021 01:27:16 -0700 (PDT) From: Vitaly Kuznetsov To: Sean Christopherson , Paolo Bonzini Cc: Wanpeng Li , Jim Mattson , Joerg Roedel , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+200c08e88ae818f849ce@syzkaller.appspotmail.com Subject: Re: [PATCH 1/3] Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" In-Reply-To: <20210831164224.1119728-2-seanjc@google.com> References: <20210831164224.1119728-1-seanjc@google.com> <20210831164224.1119728-2-seanjc@google.com> Date: Wed, 01 Sep 2021 10:27:15 +0200 Message-ID: <87pmtsog4c.fsf@vitty.brq.redhat.com> MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Sean Christopherson writes: > Revert a misguided illegal GPA check when "translating" a non-nested GPA. > The check is woefully incomplete as it does not fill in @exception as > expected by all callers, which leads to KVM attempting to inject a bogus > exception, potentially exposing kernel stack information in the process. > > WARNING: CPU: 0 PID: 8469 at arch/x86/kvm/x86.c:525 exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525 > CPU: 1 PID: 8469 Comm: syz-executor531 Not tainted 5.14.0-rc7-syzkaller #0 > RIP: 0010:exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525 > Call Trace: > x86_emulate_instruction+0xef6/0x1460 arch/x86/kvm/x86.c:7853 > kvm_mmu_page_fault+0x2f0/0x1810 arch/x86/kvm/mmu/mmu.c:5199 > handle_ept_misconfig+0xdf/0x3e0 arch/x86/kvm/vmx/vmx.c:5336 > __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6021 [inline] > vmx_handle_exit+0x336/0x1800 arch/x86/kvm/vmx/vmx.c:6038 > vcpu_enter_guest+0x2a1c/0x4430 arch/x86/kvm/x86.c:9712 > vcpu_run arch/x86/kvm/x86.c:9779 [inline] > kvm_arch_vcpu_ioctl_run+0x47d/0x1b20 arch/x86/kvm/x86.c:10010 > kvm_vcpu_ioctl+0x49e/0xe50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3652 > > The bug has escaped notice because practically speaking the GPA check is > useless. The GPA check in question only comes into play when KVM is > walking guest page tables (or "translating" CR3), and KVM already handles > illegal GPA checks by setting reserved bits in rsvd_bits_mask for each > PxE, or in the case of CR3 for loading PTDPTRs, manually checks for an > illegal CR3. This particular failure doesn't hit the existing reserved > bits checks because syzbot sets guest.MAXPHYADDR=1, and IA32 architecture > simply doesn't allow for such an absurd MAXPHADDR, e.g. 32-bit paging "MAXPHYADDR" > doesn't define any reserved PA bits checks, which KVM emulates by only > incorporating the reserved PA bits into the "high" bits, i.e. bits 63:32. > > Simply remove the bogus check. There is zero meaningful value and no > architectural justification for supporting guest.MAXPHYADDR < 32, and > properly filling the exception would introduce non-trivial complexity. > > This reverts commit ec7771ab471ba6a945350353617e2e3385d0e013. > > Fixes: ec7771ab471b ("KVM: x86: mmu: Add guest physical address check in translate_gpa()") > Cc: stable@vger.kernel.org > Reported-by: syzbot+200c08e88ae818f849ce@syzkaller.appspotmail.com > Signed-off-by: Sean Christopherson > --- > arch/x86/kvm/mmu/mmu.c | 6 ------ > 1 file changed, 6 deletions(-) > > diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c > index 4853c033e6ce..4b7908187d05 100644 > --- a/arch/x86/kvm/mmu/mmu.c > +++ b/arch/x86/kvm/mmu/mmu.c > @@ -334,12 +334,6 @@ static bool check_mmio_spte(struct kvm_vcpu *vcpu, u64 spte) > static gpa_t translate_gpa(struct kvm_vcpu *vcpu, gpa_t gpa, u32 access, > struct x86_exception *exception) > { > - /* Check if guest physical address doesn't exceed guest maximum */ > - if (kvm_vcpu_is_illegal_gpa(vcpu, gpa)) { > - exception->error_code |= PFERR_RSVD_MASK; > - return UNMAPPED_GVA; > - } > - > return gpa; > } Reviewed-by: Vitaly Kuznetsov I'm, however, wondering if it would also make sense to forbid setting nonsensical MAXPHYADDR, something like (compile-only tested): diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index fe03bd978761..42e71ac8ff31 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -73,25 +73,6 @@ static inline struct kvm_cpuid_entry2 *cpuid_entry2_find( return NULL; } -static int kvm_check_cpuid(struct kvm_cpuid_entry2 *entries, int nent) -{ - struct kvm_cpuid_entry2 *best; - - /* - * The existing code assumes virtual address is 48-bit or 57-bit in the - * canonical address checks; exit if it is ever changed. - */ - best = cpuid_entry2_find(entries, nent, 0x80000008, 0); - if (best) { - int vaddr_bits = (best->eax & 0xff00) >> 8; - - if (vaddr_bits != 48 && vaddr_bits != 57 && vaddr_bits != 0) - return -EINVAL; - } - - return 0; -} - void kvm_update_pv_runtime(struct kvm_vcpu *vcpu) { struct kvm_cpuid_entry2 *best; @@ -208,20 +189,48 @@ static void kvm_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu) kvm_mmu_after_set_cpuid(vcpu); } -int cpuid_query_maxphyaddr(struct kvm_vcpu *vcpu) +static int __cpuid_query_maxphyaddr(struct kvm_cpuid_entry2 *entries, int nent) { struct kvm_cpuid_entry2 *best; - best = kvm_find_cpuid_entry(vcpu, 0x80000000, 0); + best = cpuid_entry2_find(entries, nent, 0x80000000, 0); if (!best || best->eax < 0x80000008) goto not_found; - best = kvm_find_cpuid_entry(vcpu, 0x80000008, 0); + best = cpuid_entry2_find(entries, nent, 0x80000008, 0); if (best) return best->eax & 0xff; not_found: return 36; } +int cpuid_query_maxphyaddr(struct kvm_vcpu *vcpu) +{ + return __cpuid_query_maxphyaddr(vcpu->arch.cpuid_entries, vcpu->arch.cpuid_nent); +} + +static int kvm_check_cpuid(struct kvm_cpuid_entry2 *entries, int nent) +{ + struct kvm_cpuid_entry2 *best; + + /* guest.MAXPHYADDR < 32 is completely nonsensical */ + if (__cpuid_query_maxphyaddr(entries, nent) < 32) + return -EINVAL; + + /* + * The existing code assumes virtual address is 48-bit or 57-bit in the + * canonical address checks; exit if it is ever changed. + */ + best = cpuid_entry2_find(entries, nent, 0x80000008, 0); + if (best) { + int vaddr_bits = (best->eax & 0xff00) >> 8; + + if (vaddr_bits != 48 && vaddr_bits != 57 && vaddr_bits != 0) + return -EINVAL; + } + + return 0; +} + /* * This "raw" version returns the reserved GPA bits without any adjustments for * encryption technologies that usurp bits. The raw mask should be used if and -- Vitaly