From patchwork Thu Jan 11 02:03:07 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10156697 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0E82360231 for ; Thu, 11 Jan 2018 02:20:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EF8A3286D4 for ; Thu, 11 Jan 2018 02:20:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E3060286D6; Thu, 11 Jan 2018 02:20:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DCB37286D4 for ; Thu, 11 Jan 2018 02:20:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752870AbeAKCTi (ORCPT ); Wed, 10 Jan 2018 21:19:38 -0500 Received: from mail-pf0-f193.google.com ([209.85.192.193]:36281 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754035AbeAKCTf (ORCPT ); Wed, 10 Jan 2018 21:19:35 -0500 Received: by mail-pf0-f193.google.com with SMTP id 23so8675pfp.3 for ; Wed, 10 Jan 2018 18:19:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=egztmSnqWTsWRsR+CBZrBrCh5AF9XONRxMOOkE6+X/0=; b=JTlptZy8c0LOaSOQbOk9QARwV52WMBRg6T5pDn/IfHt3o8axPrIvjhyz/v7Fa7xRVE isgnEWTxdpoaZXpMxeun2H8RW3QyKjnxaJKpvtm274jgvETS8sWI6Ydo2lHWVgATzRqG UR4ACQ38gDcWmbz38Bawcfn4CHMAuvqB/RiiA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=egztmSnqWTsWRsR+CBZrBrCh5AF9XONRxMOOkE6+X/0=; b=iNLEnNR0CJerNOELIgkyak6YKOzePtewsDjE0KliHIEoKGTDtHM5Lpz2C+3K5H/861 lJJq5Jp6I9pwJXmVTh65Xy3RiMGvTOxANly5NDyhxXvFr8NZCLzMoxM9wGs6gNj/Fgdu vviPnJ9AE6QhieZV4bBW/FWMHM3/9MDvqsATfM/HNI8LVJFbnAFuO27GLPUJ6oR4pC6F ZX31nYCXSmJjc73NyFYPsVk7RMeVr++nTzDe5OlnsJjfPbd4oNMNUDYTndstM5TPvQVs ROw7G+dS1qO+7RzKzVojTnm0KO3s0VNrHu1st9ROEomqrCNxffHs6qvKbq//+3j9isqe OeHA== X-Gm-Message-State: AKGB3mJXKhJTN5eowk0p6lw2OiTEnuC6HrDLixRg6pHEC9jadAaQgZ1P tekIP6Y86QOS+1VEtqFD/OaIgQ== X-Google-Smtp-Source: ACJfBosY3jfUbaE/EQIyBkHfxLjutv6k5hqHGCcjebynQV0LlqniiUPjjtu2D8Q26ZCW08IAuw+Qww== X-Received: by 10.101.93.79 with SMTP id e15mr8655050pgt.129.1515637174710; Wed, 10 Jan 2018 18:19:34 -0800 (PST) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id p24sm35652879pfh.170.2018.01.10.18.19.32 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 10 Jan 2018 18:19:33 -0800 (PST) From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Kees Cook , Paolo Bonzini , kernel-hardening@lists.openwall.com, Christian Borntraeger , Christoffer Dall , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Linus Torvalds , David Windsor , Alexander Viro , Andrew Morton , Andy Lutomirski , Christoph Hellwig , Christoph Lameter , "David S. Miller" , Laura Abbott , Mark Rutland , "Martin K. Petersen" , Christian Borntraeger , Christoffer Dall , Dave Kleikamp , Jan Kara , Luis de Bethencourt , Marc Zyngier , Rik van Riel , Matthew Garrett , linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, netdev@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 35/38] kvm: whitelist struct kvm_vcpu_arch Date: Wed, 10 Jan 2018 18:03:07 -0800 Message-Id: <1515636190-24061-36-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1515636190-24061-1-git-send-email-keescook@chromium.org> References: <1515636190-24061-1-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Paolo Bonzini On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region that is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, KVM is completely broken on those architectures with usercopy hardening enabled. For now, allow writing to the entire struct on all architectures. The KVM tree will not refine this to an architecture-specific subset of struct kvm_vcpu_arch. Cc: kernel-hardening@lists.openwall.com Cc: Kees Cook Cc: Christian Borntraeger Cc: Christoffer Dall Cc: Radim Krčmář Signed-off-by: Paolo Bonzini Acked-by: Christoffer Dall Acked-by: Marc Zyngier Acked-by: Christian Borntraeger Signed-off-by: Kees Cook --- virt/kvm/kvm_main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index c422c10cd1dd..96689967f5c3 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -4029,8 +4029,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, /* A kmem cache lets us meet the alignment requirements of fx_save. */ if (!vcpu_align) vcpu_align = __alignof__(struct kvm_vcpu); - kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, - SLAB_ACCOUNT, NULL); + kvm_vcpu_cache = + kmem_cache_create_usercopy("kvm_vcpu", vcpu_size, vcpu_align, + SLAB_ACCOUNT, + offsetof(struct kvm_vcpu, arch), + sizeof_field(struct kvm_vcpu, arch), + NULL); if (!kvm_vcpu_cache) { r = -ENOMEM; goto out_free_3;