From patchwork Fri Jul 28 00:12:57 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Luczaj X-Patchwork-Id: 13330987 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0871AC41513 for ; Fri, 28 Jul 2023 00:17:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231221AbjG1ARJ (ORCPT ); Thu, 27 Jul 2023 20:17:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229487AbjG1ARH (ORCPT ); Thu, 27 Jul 2023 20:17:07 -0400 Received: from mailtransmit04.runbox.com (mailtransmit04.runbox.com [IPv6:2a0c:5a00:149::25]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4CAC2139 for ; Thu, 27 Jul 2023 17:16:59 -0700 (PDT) Received: from mailtransmit03.runbox ([10.9.9.163] helo=aibo.runbox.com) by mailtransmit04.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1qPBA4-004ru0-9w; Fri, 28 Jul 2023 02:16:52 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector1; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:Cc:To:From; bh=7VJYracmdU1lDrqbKMkKJZZF7M7W8sV60Ahyvmh99lo=; b=PGPXMDRrQ7Ar6mYIvuWjhFMV62 gQU+aoBtNWkD5Fz+sloLtCnYkNVf+CcwMXXg8cME2yic0DbzdH9hRThFDL9cc0d/B9YTWY5aNlZfi zZy3j9Q8glgyPidYAF/Dl6jdj8VSDmYs8ExPklEZDr3gUd3Z319GD6n9n5czXcmPKcK4+4nLH5FV+ A+knG8vAsfDJ9TxRguyxoI8I493e0tKShjSk+DqbkDK+2w41/BsLrhTM4Dn7WHknZSTyp2UHPDAQx KKCsZmk9FKmY6b/F7X1vlZ+E+/O8h2IZQkyA1+YvBrbPUP7Ss7C/OdMm6qKtuOSLAgRJiqWKyloas b2e8Jpfw==; Received: from [10.9.9.74] (helo=submission03.runbox) by mailtransmit03.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1qPBA4-0002hb-1r; Fri, 28 Jul 2023 02:16:52 +0200 Received: by submission03.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) id 1qPB9y-0000WA-DL; Fri, 28 Jul 2023 02:16:46 +0200 From: Michal Luczaj To: seanjc@google.com Cc: pbonzini@redhat.com, kvm@vger.kernel.org, shuah@kernel.org, Michal Luczaj Subject: [PATCH 1/2] KVM: x86: Fix KVM_CAP_SYNC_REGS's sync_regs() TOCTOU issues Date: Fri, 28 Jul 2023 02:12:57 +0200 Message-ID: <20230728001606.2275586-2-mhal@rbox.co> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230728001606.2275586-1-mhal@rbox.co> References: <20230728001606.2275586-1-mhal@rbox.co> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org In a spirit of using a sledgehammer to crack a nut, make sync_regs() feed __set_sregs() and kvm_vcpu_ioctl_x86_set_vcpu_events() with kernel's own copy of data. Both __set_sregs() and kvm_vcpu_ioctl_x86_set_vcpu_events() assume they have exclusive rights to structs they operate on. While this is true when coming from an ioctl handler (caller makes a local copy of user's data), sync_regs() breaks this contract; a pointer to a user-modifiable memory (vcpu->run->s.regs) is provided. This can lead to a situation when incoming data is checked and/or sanitized only to be re-set by a user thread running in parallel. Signed-off-by: Michal Luczaj --- A note: when servicing kvm_run->kvm_dirty_regs, changes made by __set_sregs()/kvm_vcpu_ioctl_x86_set_vcpu_events() to on-stack copies of vcpu->run.s.regs will not be reflected back in vcpu->run.s.regs. Is this ok? arch/x86/kvm/x86.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 7f4246e4255f..eb94081bd7e4 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -11787,15 +11787,22 @@ static int sync_regs(struct kvm_vcpu *vcpu) __set_regs(vcpu, &vcpu->run->s.regs.regs); vcpu->run->kvm_dirty_regs &= ~KVM_SYNC_X86_REGS; } + if (vcpu->run->kvm_dirty_regs & KVM_SYNC_X86_SREGS) { - if (__set_sregs(vcpu, &vcpu->run->s.regs.sregs)) + struct kvm_sregs sregs = vcpu->run->s.regs.sregs; + + if (__set_sregs(vcpu, &sregs)) return -EINVAL; + vcpu->run->kvm_dirty_regs &= ~KVM_SYNC_X86_SREGS; } + if (vcpu->run->kvm_dirty_regs & KVM_SYNC_X86_EVENTS) { - if (kvm_vcpu_ioctl_x86_set_vcpu_events( - vcpu, &vcpu->run->s.regs.events)) + struct kvm_vcpu_events events = vcpu->run->s.regs.events; + + if (kvm_vcpu_ioctl_x86_set_vcpu_events(vcpu, &events)) return -EINVAL; + vcpu->run->kvm_dirty_regs &= ~KVM_SYNC_X86_EVENTS; } From patchwork Fri Jul 28 00:12:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Luczaj X-Patchwork-Id: 13330986 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56A17C0015E for ; Fri, 28 Jul 2023 00:17:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231202AbjG1ARI (ORCPT ); Thu, 27 Jul 2023 20:17:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230010AbjG1ARH (ORCPT ); Thu, 27 Jul 2023 20:17:07 -0400 Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [IPv6:2a0c:5a00:149::26]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 04A0A2703 for ; Thu, 27 Jul 2023 17:16:59 -0700 (PDT) Received: from mailtransmit03.runbox ([10.9.9.163] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1qPBA1-004WRd-7H; Fri, 28 Jul 2023 02:16:49 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector1; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:Cc:To:From; bh=S7WzY3cM95KMpMl3Uv2Vje9npSPbh7xjo5rDpXQwg/g=; b=Im2/WSnhCBAAE3jqCAJkJR5nYg wKH/l03Aqs8yRDAZayR+a2DbmvI7cEYRH3Yilh8XoQeKUs7S1Q9eNtCKrQEm0m5vUkOkBOliDoRBb FCyzmlu74gUeYTBR5rWRgHY08e0HA4ORBE3W1q87gdSAKCmSgk96ZHdIVSqe/aeq3549QjNJj1a65 tNDhbATqWgugSJZryRPgFJSmVt+twVN1/DXJH4rDbg6fgCDs6AU0ebFGPdzeN6OUIp1VLHG4pZ+GF nPbSp4OHDTj1l9US4oX7/EIhnXF61xrO5m1cvtZDoJAEQtEjw+J7gRjHI3qbq1GoHLs6Rf8dDAq9i BzGpnrYA==; Received: from [10.9.9.74] (helo=submission03.runbox) by mailtransmit03.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1qPBA0-0002hQ-Qg; Fri, 28 Jul 2023 02:16:48 +0200 Received: by submission03.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) id 1qPB9y-0000WA-P2; Fri, 28 Jul 2023 02:16:46 +0200 From: Michal Luczaj To: seanjc@google.com Cc: pbonzini@redhat.com, kvm@vger.kernel.org, shuah@kernel.org, Michal Luczaj Subject: [PATCH 2/2] KVM: selftests: Extend x86's sync_regs_test to check for races Date: Fri, 28 Jul 2023 02:12:58 +0200 Message-ID: <20230728001606.2275586-3-mhal@rbox.co> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230728001606.2275586-1-mhal@rbox.co> References: <20230728001606.2275586-1-mhal@rbox.co> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Attempt to modify vcpu->run->s.regs _after_ the sanity checks performed by KVM_CAP_SYNC_REGS's arch/x86/kvm/x86.c:sync_regs(). This could lead to some nonsensical vCPU states accompanied by kernel splats. Signed-off-by: Michal Luczaj --- .../selftests/kvm/x86_64/sync_regs_test.c | 124 ++++++++++++++++++ 1 file changed, 124 insertions(+) diff --git a/tools/testing/selftests/kvm/x86_64/sync_regs_test.c b/tools/testing/selftests/kvm/x86_64/sync_regs_test.c index 2da89fdc2471..feebc7d44c17 100644 --- a/tools/testing/selftests/kvm/x86_64/sync_regs_test.c +++ b/tools/testing/selftests/kvm/x86_64/sync_regs_test.c @@ -15,12 +15,14 @@ #include #include #include +#include #include "test_util.h" #include "kvm_util.h" #include "processor.h" #define UCALL_PIO_PORT ((uint16_t)0x1000) +#define TIMEOUT 2 /* seconds, roughly */ struct ucall uc_none = { .cmd = UCALL_NONE, @@ -80,6 +82,124 @@ static void compare_vcpu_events(struct kvm_vcpu_events *left, #define TEST_SYNC_FIELDS (KVM_SYNC_X86_REGS|KVM_SYNC_X86_SREGS|KVM_SYNC_X86_EVENTS) #define INVALID_SYNC_FIELD 0x80000000 +/* + * WARNING: CPU: 0 PID: 1115 at arch/x86/kvm/x86.c:10095 kvm_check_and_inject_events+0x220/0x500 [kvm] + * + * arch/x86/kvm/x86.c:kvm_check_and_inject_events(): + * WARN_ON_ONCE(vcpu->arch.exception.injected && + * vcpu->arch.exception.pending); + */ +static void *race_events_inj_pen(void *arg) +{ + struct kvm_run *run = (struct kvm_run *)arg; + struct kvm_vcpu_events *events = &run->s.regs.events; + + for (;;) { + WRITE_ONCE(run->kvm_dirty_regs, KVM_SYNC_X86_EVENTS); + WRITE_ONCE(events->flags, 0); + WRITE_ONCE(events->exception.injected, 1); + WRITE_ONCE(events->exception.pending, 1); + + pthread_testcancel(); + } + + return NULL; +} + +/* + * WARNING: CPU: 0 PID: 1107 at arch/x86/kvm/x86.c:547 kvm_check_and_inject_events+0x4a0/0x500 [kvm] + * + * arch/x86/kvm/x86.c:exception_type(): + * WARN_ON(vector > 31 || vector == NMI_VECTOR) + */ +static void *race_events_exc(void *arg) +{ + struct kvm_run *run = (struct kvm_run *)arg; + struct kvm_vcpu_events *events = &run->s.regs.events; + + for (;;) { + WRITE_ONCE(run->kvm_dirty_regs, KVM_SYNC_X86_EVENTS); + WRITE_ONCE(events->flags, 0); + WRITE_ONCE(events->exception.pending, 1); + WRITE_ONCE(events->exception.nr, 255); + + pthread_testcancel(); + } + + return NULL; +} + +/* + * WARNING: CPU: 0 PID: 1142 at arch/x86/kvm/mmu/paging_tmpl.h:358 paging32_walk_addr_generic+0x431/0x8f0 [kvm] + * + * arch/x86/kvm/mmu/paging_tmpl.h: + * KVM_BUG_ON(is_long_mode(vcpu) && !is_pae(vcpu), vcpu->kvm) + */ +static void *race_sregs_cr4(void *arg) +{ + struct kvm_run *run = (struct kvm_run *)arg; + __u64 *cr4 = &run->s.regs.sregs.cr4; + __u64 pae_enabled = *cr4; + __u64 pae_disabled = *cr4 & ~X86_CR4_PAE; + + for (;;) { + WRITE_ONCE(run->kvm_dirty_regs, KVM_SYNC_X86_SREGS); + WRITE_ONCE(*cr4, pae_enabled); + asm volatile(".rept 512\n\t" + "nop\n\t" + ".endr"); + WRITE_ONCE(*cr4, pae_disabled); + + pthread_testcancel(); + } + + return NULL; +} + +static void race_sync_regs(void *racer, bool poke_mmu) +{ + struct kvm_translation tr; + struct kvm_vcpu *vcpu; + struct kvm_run *run; + struct kvm_vm *vm; + pthread_t thread; + time_t t; + + vm = vm_create_with_one_vcpu(&vcpu, guest_code); + run = vcpu->run; + + run->kvm_valid_regs = KVM_SYNC_X86_SREGS; + vcpu_run(vcpu); + TEST_REQUIRE(run->s.regs.sregs.cr4 & X86_CR4_PAE); + run->kvm_valid_regs = 0; + + ASSERT_EQ(pthread_create(&thread, NULL, racer, (void *)run), 0); + + for (t = time(NULL) + TIMEOUT; time(NULL) < t;) { + __vcpu_run(vcpu); + + if (poke_mmu) { + tr = (struct kvm_translation) { .linear_address = 0 }; + __vcpu_ioctl(vcpu, KVM_TRANSLATE, &tr); + } + } + + ASSERT_EQ(pthread_cancel(thread), 0); + ASSERT_EQ(pthread_join(thread, NULL), 0); + + /* + * If kvm->bugged then we won't survive TEST_ASSERT(). Leak. + * + * kvm_vm_free() + * __vm_mem_region_delete() + * vm_ioctl(vm, KVM_SET_USER_MEMORY_REGION, ®ion->region) + * _vm_ioctl(vm, cmd, #cmd, arg) + * TEST_ASSERT(!ret, __KVM_IOCTL_ERROR(name, ret)) + */ + if (!poke_mmu) + kvm_vm_free(vm); +} + int main(int argc, char *argv[]) { struct kvm_vcpu *vcpu; @@ -218,5 +338,9 @@ int main(int argc, char *argv[]) kvm_vm_free(vm); + race_sync_regs(race_sregs_cr4, true); + race_sync_regs(race_events_exc, false); + race_sync_regs(race_events_inj_pen, false); + return 0; }