From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932622AbdJYKb6 (ORCPT ); Wed, 25 Oct 2017 06:31:58 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:59356 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932463AbdJYKbw (ORCPT ); Wed, 25 Oct 2017 06:31:52 -0400 Subject: Re: [PATCH 0/2] KVM: fixes for the kernel-hardening tree To: David Hildenbrand , Paolo Bonzini , Cornelia Huck Cc: linux-kernel@vger.kernel.org, kvm@vger.kernel.org, kernel-hardening@lists.openwall.com, Kees Cook , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Christoffer Dall , Marc Zyngier , James Hogan , Paul Mackerras References: <20171020232525.7387-1-pbonzini@redhat.com> <20171023143918.21112222.cohuck@redhat.com> <6fbcdbac-a717-def4-1864-6426d58986fc@redhat.com> From: Christian Borntraeger Date: Wed, 25 Oct 2017 12:31:43 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 x-cbid: 17102510-0008-0000-0000-000004A3B308 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17102510-0009-0000-0000-00001E362080 Message-Id: <88d8a69a-5fe6-a38f-21c1-944ed551c2ad@de.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-10-25_05:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1710250144 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/25/2017 11:45 AM, David Hildenbrand wrote: > On 23.10.2017 16:15, Paolo Bonzini wrote: >> On 23/10/2017 14:39, Cornelia Huck wrote: >>> On Mon, 23 Oct 2017 11:52:51 +0200 >>> David Hildenbrand wrote: >>> >>>> On 21.10.2017 01:25, Paolo Bonzini wrote: >>>>> Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries >>>>> field of struct kvm_vcpu_arch. Therefore, the new usercopy hardening >>>>> work in linux-next, which forbids copies from and to slab objects >>>>> unless they are from kmalloc or explicitly whitelisted, breaks KVM >>>>> completely. >>>>> >>>>> This series fixes it by adding the two new usercopy arguments >>>>> to kvm_init (more precisely to a new function kvm_init_usercopy, >>>>> while kvm_init passes zeroes as a default). >>>>> >>>>> There's also another broken ioctl, KVM_XEN_HVM_CONFIG, but it is >>>>> obsolete and not a big deal at all. >>>>> >>>>> I'm Ccing all submaintainers in case they have something similar >>>>> going on in their kvm_arch and kvm_vcpu_arch structs. KVM has a >>>>> pretty complex userspace API, so thorough with linux-next is highly >>>>> recommended. >>>> >>>> I assume on s390x, at least >>>> >>>> kvm_arch_vcpu_ioctl_get_one_reg() and >>>> kvm_arch_vcpu_ioctl_set_one_reg() >>>> >>>> have to be fixed. >>> >>> At a glance, seems like it. >>> >>>> >>>> Christian, are you already looking into this? >>> >>> I'm afraid I'm also busy with travel preparation/travel, so I'd be glad >>> for any takers. >> >> Let's do a generic fix now, so that we don't need to rush the switch to >> explicit whitelisting. > > You mean a arch specific fix (allow writes/reads to arch) or even more > generic? Kees, I am somewhat worried about these changes. The onereg interface is certainly broken right now, but newer QEMUs will not use it. So its very likely that testing will not find the regression. I would assume that usercopy hardinging will introduce a lot of non-obvious regressions in seldomly used code. Have you considered some debugging aids to find "now broken" things? > > Otherwise I can you send a patch to fix these two functions. Having said that, yes if you can send a fixup for kvm_arch_vcpu_ioctl_get/set_one_reg that would be great. Christian