From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932326AbdJWOPr (ORCPT ); Mon, 23 Oct 2017 10:15:47 -0400 Received: from mx1.redhat.com ([209.132.183.28]:43769 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751198AbdJWOPq (ORCPT ); Mon, 23 Oct 2017 10:15:46 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 838B43AAC1 Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com Subject: Re: [PATCH 0/2] KVM: fixes for the kernel-hardening tree To: Cornelia Huck , David Hildenbrand Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, kernel-hardening@lists.openwall.com, Kees Cook , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Christoffer Dall , Marc Zyngier , Christian Borntraeger , James Hogan , Paul Mackerras References: <20171020232525.7387-1-pbonzini@redhat.com> <20171023143918.21112222.cohuck@redhat.com> From: Paolo Bonzini Message-ID: <6fbcdbac-a717-def4-1864-6426d58986fc@redhat.com> Date: Mon, 23 Oct 2017 16:15:32 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <20171023143918.21112222.cohuck@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Mon, 23 Oct 2017 14:15:46 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 23/10/2017 14:39, Cornelia Huck wrote: > On Mon, 23 Oct 2017 11:52:51 +0200 > David Hildenbrand wrote: > >> On 21.10.2017 01:25, Paolo Bonzini wrote: >>> Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries >>> field of struct kvm_vcpu_arch. Therefore, the new usercopy hardening >>> work in linux-next, which forbids copies from and to slab objects >>> unless they are from kmalloc or explicitly whitelisted, breaks KVM >>> completely. >>> >>> This series fixes it by adding the two new usercopy arguments >>> to kvm_init (more precisely to a new function kvm_init_usercopy, >>> while kvm_init passes zeroes as a default). >>> >>> There's also another broken ioctl, KVM_XEN_HVM_CONFIG, but it is >>> obsolete and not a big deal at all. >>> >>> I'm Ccing all submaintainers in case they have something similar >>> going on in their kvm_arch and kvm_vcpu_arch structs. KVM has a >>> pretty complex userspace API, so thorough with linux-next is highly >>> recommended. >> >> I assume on s390x, at least >> >> kvm_arch_vcpu_ioctl_get_one_reg() and >> kvm_arch_vcpu_ioctl_set_one_reg() >> >> have to be fixed. > > At a glance, seems like it. > >> >> Christian, are you already looking into this? > > I'm afraid I'm also busy with travel preparation/travel, so I'd be glad > for any takers. Let's do a generic fix now, so that we don't need to rush the switch to explicit whitelisting. Paolo