From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030317AbcGKHnf (ORCPT ); Mon, 11 Jul 2016 03:43:35 -0400 Received: from mail-lf0-f67.google.com ([209.85.215.67]:33614 "EHLO mail-lf0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758039AbcGKHnc (ORCPT ); Mon, 11 Jul 2016 03:43:32 -0400 Subject: Re: [PATCH v2 04/13] KVM: x86: dynamic kvm_apic_map To: Yang Zhang , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , linux-kernel@vger.kernel.org, kvm@vger.kernel.org References: <20160707171550.14675-1-rkrcmar@redhat.com> <20160707171550.14675-5-rkrcmar@redhat.com> <963b542a-1111-db83-8338-c32d44f98874@gmail.com> Cc: "Lan, Tianyu" , Igor Mammedov , Jan Kiszka , Peter Xu From: Paolo Bonzini Message-ID: Date: Mon, 11 Jul 2016 09:43:24 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <963b542a-1111-db83-8338-c32d44f98874@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/07/2016 08:07, Yang Zhang wrote: >> >> mutex_lock(&kvm->arch.apic_map_lock); >> >> + kvm_for_each_vcpu(i, vcpu, kvm) >> + if (kvm_apic_present(vcpu)) >> + max_id = max(max_id, kvm_apic_id(vcpu->arch.apic)); >> + >> + new = kzalloc(sizeof(struct kvm_apic_map) + >> + sizeof(struct kvm_lapic *) * (max_id + 1), >> GFP_KERNEL); >> + > > I think this may cause the host runs out of memory if a malicious guest > did follow thing: > 1. vcpu a is doing apic map recalculation. > 2. vcpu b write the apic id with 0xff > 3. then vcpu b enable the x2apic: in kvm_lapic_set_base(), we will set > apic_base to new value before reset the apic id. > 4. vcpu a may see the x2apic enabled in vcpu b plus an old apic > id(0xff), and max_id will become (0xff >> 24). The bug is not really here but in patch 6---but you're right nevertheless! I guess the easiest solution is to replace kvm_apic_id with a field in struct kvm_lapic, which is already shifted right by 24 in xAPIC mode. It can be added easily in patch 6 itself, it's like 3 new lines of code because all reads and writes go through kvm_apic_id and kvm_apic_set_id; the kvm_apic_id wrapper can be kept for simplicity. Thanks again! Paolo