* [PATCH] KVM: arm64: Fix alignment of kvm_hyp_memcache allocations
@ 2025-02-13 15:36 Quentin Perret
2025-02-13 18:02 ` Marc Zyngier
0 siblings, 1 reply; 2+ messages in thread
From: Quentin Perret @ 2025-02-13 15:36 UTC (permalink / raw)
To: Marc Zyngier, Oliver Upton, Joey Gouly, Suzuki K Poulose,
Zenghui Yu, Catalin Marinas, Will Deacon
Cc: Keir Fraser, Ben Simner, linux-arm-kernel, kvmarm, linux-kernel
When allocating guest stage-2 page-table pages at EL2, pKVM can consume
pages from the host-provided kvm_hyp_memcache. As pgtable.c expects
zeroed pages, guest_s2_zalloc_page() actively implements this zeroing
with a PAGE_SIZE memset. Unfortunately, we don't check the page
alignment of the host-provided address before doing so, which could
lead to the memset overrunning the page if the host was malicious.
Fix this by simply force-aligning all kvm_hyp_memcache allocations to
page boundaries.
Fixes: 60dfe093ec13 ("KVM: arm64: Instantiate guest stage-2 page-tables at EL2")
Reported-by: Ben Simner <ben.simner@cl.cam.ac.uk>
Signed-off-by: Quentin Perret <qperret@google.com>
---
arch/arm64/include/asm/kvm_host.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 7cfa024de4e3..d9db6dfbad09 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -100,7 +100,7 @@ static inline void push_hyp_memcache(struct kvm_hyp_memcache *mc,
static inline void *pop_hyp_memcache(struct kvm_hyp_memcache *mc,
void *(*to_va)(phys_addr_t phys))
{
- phys_addr_t *p = to_va(mc->head);
+ phys_addr_t *p = to_va(mc->head & PAGE_MASK);
if (!mc->nr_pages)
return NULL;
--
2.48.1.502.g6dc24dfdaf-goog
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] KVM: arm64: Fix alignment of kvm_hyp_memcache allocations
2025-02-13 15:36 [PATCH] KVM: arm64: Fix alignment of kvm_hyp_memcache allocations Quentin Perret
@ 2025-02-13 18:02 ` Marc Zyngier
0 siblings, 0 replies; 2+ messages in thread
From: Marc Zyngier @ 2025-02-13 18:02 UTC (permalink / raw)
To: Oliver Upton, Joey Gouly, Suzuki K Poulose, Zenghui Yu,
Catalin Marinas, Will Deacon, Quentin Perret
Cc: Keir Fraser, Ben Simner, linux-arm-kernel, kvmarm, linux-kernel
On Thu, 13 Feb 2025 15:36:14 +0000, Quentin Perret wrote:
> When allocating guest stage-2 page-table pages at EL2, pKVM can consume
> pages from the host-provided kvm_hyp_memcache. As pgtable.c expects
> zeroed pages, guest_s2_zalloc_page() actively implements this zeroing
> with a PAGE_SIZE memset. Unfortunately, we don't check the page
> alignment of the host-provided address before doing so, which could
> lead to the memset overrunning the page if the host was malicious.
>
> [...]
Applied to fixes, thanks!
[1/1] KVM: arm64: Fix alignment of kvm_hyp_memcache allocations
commit: b938731ed2d4eea8e268a27bfc600581fedae2a9
Cheers,
M.
--
Without deviation from the norm, progress is not possible.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-02-13 18:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-02-13 15:36 [PATCH] KVM: arm64: Fix alignment of kvm_hyp_memcache allocations Quentin Perret
2025-02-13 18:02 ` Marc Zyngier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®