From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f73.google.com (mail-pj1-f73.google.com [209.85.216.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4341E182D0 for ; Sat, 1 Feb 2025 01:14:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738372445; cv=none; b=Ap5oyCAinurwYxkvkg1eGxuKvL6eql4pLX0KlraBaZs7VZ+q7kgArkAelu4fhE18ygXSm97NcxCKt8vHCJ711y4l28y6ggXTjIWmbapCRJpq8Dixrt1YYGaDPTPhiCxTOBmCFiCNHxag1VXQ1yYwUS/x3w87hNgayAp41TrTK6c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738372445; c=relaxed/simple; bh=gDa1qhX91wsfWEYeXVozciwOxp3uGwMjlCxhzjYjjx8=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=U+cOQJ/mgRheXNlYF3+6MhYBj0tHdOoPRq7IbdXOV6/F/3HD8RoK5dcY+F0VDrS7yVCgf+Xy7kp2gAh7S2rMd0a+vfTLCzkjoltePRXyg3QKf3SQ2lPjeg1IPExAmwojhi/vl/j27HRLAXKQA4DaKkP1LptrSnCwFitofgMqTsM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=rRigvXpr; arc=none smtp.client-ip=209.85.216.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="rRigvXpr" Received: by mail-pj1-f73.google.com with SMTP id 98e67ed59e1d1-2ef9b9981f1so7156686a91.3 for ; Fri, 31 Jan 2025 17:14:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1738372443; x=1738977243; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:reply-to:from:to:cc :subject:date:message-id:reply-to; bh=6IvXp6LawXcmBH5LaQWsjNSSz2+k/ZgcOemyGwVuzTI=; b=rRigvXprLQr60GIRf1LjfRRStAppw7SEW2YzsuRwxYbz79VHsDMIMdubhUk3kk8uO/ SoPCzBH83o0BgdE9uq77tkD6rF7Mw93VwND+2DJFOanG0esqA36c4oW6XZgW3FfexJhQ Xs7vLAtYOeiIlH7u5YYUZBZ8yPa6b9Z5LV7zfwmRwSxOae2d78+zGDBfL8/V1Cd9ruLM 82+xh3C2N8+OfVA1pgs6Irr/kkyKYYID9PgT3aKZRDwhF+GZkyEqpT4ZEvwevCnkBlQT 5DF9BMZzhCUYzLawVVBAdwbR+DkHEcl1b/J/1inYPxPp3d7/IfD9gRuOLcy1cwxdzt7e SJ+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738372443; x=1738977243; h=cc:to:from:subject:message-id:mime-version:date:reply-to :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=6IvXp6LawXcmBH5LaQWsjNSSz2+k/ZgcOemyGwVuzTI=; b=eYiF7EEPXXfQM+H9cqph/7XSrrnsWTz/QMN60dTBDVkfl1qLKcPxlU+X41H7TJf1Y8 +HgRwLtk5VT2VTwf79FUAueFFDxrdqc/UEjMyQzMx4smrEzXEZDLrKbpIYnrqVpCwUCA RSx5M4smTMmqI5V1af9XBiOn1h1ZjN+XvxMWvNHIV0sqwRmq36MzGiWN21R4XeeXgCC5 qARAuvm1w3HvDtY+iZftaXEV37Pw01XBt43xd1R8CFNAM6mpYW6GJ6KXA/JzQpbE54Yt /MLDagldaD2HyiWCBSRIPAd0IRdHPYIRe5sjTHErSfEvLTwMnOU/zcxx5RPPhBNXt8er B/eA== X-Forwarded-Encrypted: i=1; AJvYcCVsNbI5sldzVu4vIlenKQHvo2IugCLcapA3M7LBBzS+CSguINeKkK0zOO18eJlMkNQ27v3kiZdLRjaQPHg=@vger.kernel.org X-Gm-Message-State: AOJu0Yze+D8gG4Ku/fwdrcvMpejOO/NrS3jwuCmuBZEI6bR7dlWSroOn pq/SlquaQ1rISYcugOVqhAVlYuV5lT+i/jh+9MP3zjy2s6YeAbAlRccBL36leVoSoj9cZKup4vd ijg== X-Google-Smtp-Source: AGHT+IHVh07xgKTqbFguAoF2iaYq32Ad1Ug6CwyHoemr9AcdSO0FNfC+G6UjHvQIRnw/7HgYALo+v9DC7SE= X-Received: from pjbpx16.prod.google.com ([2002:a17:90b:2710:b0:2ea:3a1b:f493]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:1f8c:b0:2ee:9d49:3ae6 with SMTP id 98e67ed59e1d1-2f83abd7da8mr20622800a91.10.1738372443463; Fri, 31 Jan 2025 17:14:03 -0800 (PST) Reply-To: Sean Christopherson Date: Fri, 31 Jan 2025 17:13:55 -0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.48.1.362.g079036d154-goog Message-ID: <20250201011400.669483-1-seanjc@google.com> Subject: [PATCH 0/5] KVM: x86/xen: Restrict hypercall MSR index From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , David Woodhouse , Paul Durrant Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+cdeaeec70992eca2d920@syzkaller.appspotmail.com, Joao Martins , David Woodhouse Content-Type: text/plain; charset="UTF-8" Address a syzkaller splat by restricting the Xen hypercall MSR index to the de facto standard synthetic range, 0x40000000 - 0x4fffffff. This obviously has the potential to break userspace, but I'm fairly confident it'll be fine (knock wood), and doing nothing is not an option as letting userspace redirect any WRMSR is at best completely broken, and at worst could be used to exploit paths in KVM that directly write hardcoded MSRs. Patches 2-5 are tangentially related cleanups. Sean Christopherson (5): KVM: x86/xen: Restrict hypercall MSR to unofficial synthetic range KVM: x86/xen: Add an #ifdef'd helper to detect writes to Xen MSR KVM: x86/xen: Consult kvm_xen_enabled when checking for Xen MSR writes KVM: x86/xen: Bury xen_hvm_config behind CONFIG_KVM_XEN=y KVM: x86/xen: Move kvm_xen_hvm_config field into kvm_xen arch/x86/include/asm/kvm_host.h | 4 ++-- arch/x86/kvm/x86.c | 4 ++-- arch/x86/kvm/xen.c | 28 ++++++++++++++++++---------- arch/x86/kvm/xen.h | 17 +++++++++++++++-- 4 files changed, 37 insertions(+), 16 deletions(-) base-commit: eb723766b1030a23c38adf2348b7c3d1409d11f0 -- 2.48.1.362.g079036d154-goog