From patchwork Tue Aug 1 17:57:45 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: David Woodhouse X-Patchwork-Id: 13337134 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B26CCC0015E for ; Tue, 1 Aug 2023 17:58:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232113AbjHAR6X (ORCPT ); Tue, 1 Aug 2023 13:58:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233361AbjHAR6K (ORCPT ); Tue, 1 Aug 2023 13:58:10 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CAEB81BF6 for ; Tue, 1 Aug 2023 10:58:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc: To:From:Reply-To:Content-ID:Content-Description; bh=bnuFTBlWyIdK6w7isk7gkUOUHEpTYmOFBKU1JBhPJE8=; b=ATH50OTpZn6evx3teX6g2Z5miO lWsTYdrNNsTAlG6DYn1fKa9g7u14+cAbMrIu7nHsPeSJJh0+MXdTHvT9iyXq/C5p9nlzd19StllfA bwA4cKgDpiplRHHxfWdx9JyZkdl26/Q7uNbqehsjPjqncqa8zGxKO2hl2ejrwfasrB5/AIO66BLpC vHFZ3QZMtlmjRWObA7sOmyr6myk12IDxx5XS5P+llbQfqUpkMCv9LMB8InA90kwrp7WQnKS8VJCnF k7qQJTT44tc6Llv0LNvISJ8lvop4eCUbRW3S0OHi/N0E3YZUgyzun4gFnTicpCgwyQXKXqbjPfjAl G1Iv2MtA==; Received: from [2001:8b0:10b:1::ebe] (helo=i7.infradead.org) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1qQtd1-00ACU0-Dh; Tue, 01 Aug 2023 17:57:51 +0000 Received: from dwoodhou by i7.infradead.org with local (Exim 4.96 #2 (Red Hat Linux)) id 1qQtcz-000bxg-1P; Tue, 01 Aug 2023 18:57:49 +0100 From: David Woodhouse To: qemu-devel@nongnu.org Cc: Paul Durrant , Paolo Bonzini , Richard Henderson , Eduardo Habkost , "Michael S. Tsirkin" , Marcel Apfelbaum , Marcelo Tosatti , kvm@vger.kernel.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud?= =?utf-8?q?=C3=A9?= , Anthony PERARD , David Woodhouse Subject: [PATCH for-8.1 1/3] hw/xen: fix off-by-one in xen_evtchn_set_gsi() Date: Tue, 1 Aug 2023 18:57:45 +0100 Message-Id: <20230801175747.145906-2-dwmw2@infradead.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230801175747.145906-1-dwmw2@infradead.org> References: <20230801175747.145906-1-dwmw2@infradead.org> MIME-Version: 1.0 Sender: David Woodhouse X-SRS-Rewrite: SMTP reverse-path rewritten from by casper.infradead.org. See http://www.infradead.org/rpr.html Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: David Woodhouse Coverity points out (CID 1508128) a bounds checking error. We need to check for gsi >= IOAPIC_NUM_PINS, not just greater-than. Also fix up an assert() that has the same problem, that Coverity didn't see. Fixes: 4f81baa33ed6 ("hw/xen: Support GSI mapping to PIRQ") Signed-off-by: David Woodhouse Reviewed-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé --- hw/i386/kvm/xen_evtchn.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c index 3d810dbd59..0e9c108614 100644 --- a/hw/i386/kvm/xen_evtchn.c +++ b/hw/i386/kvm/xen_evtchn.c @@ -1587,7 +1587,7 @@ static int allocate_pirq(XenEvtchnState *s, int type, int gsi) found: pirq_inuse_word(s, pirq) |= pirq_inuse_bit(pirq); if (gsi >= 0) { - assert(gsi <= IOAPIC_NUM_PINS); + assert(gsi < IOAPIC_NUM_PINS); s->gsi_pirq[gsi] = pirq; } s->pirq[pirq].gsi = gsi; @@ -1601,7 +1601,7 @@ bool xen_evtchn_set_gsi(int gsi, int level) assert(qemu_mutex_iothread_locked()); - if (!s || gsi < 0 || gsi > IOAPIC_NUM_PINS) { + if (!s || gsi < 0 || gsi >= IOAPIC_NUM_PINS) { return false; } From patchwork Tue Aug 1 17:57:46 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Woodhouse X-Patchwork-Id: 13337136 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30FD2C001DF for ; Tue, 1 Aug 2023 17:58:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232308AbjHAR61 (ORCPT ); Tue, 1 Aug 2023 13:58:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53392 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233358AbjHAR6K (ORCPT ); Tue, 1 Aug 2023 13:58:10 -0400 Received: from desiato.infradead.org (desiato.infradead.org [IPv6:2001:8b0:10b:1:d65d:64ff:fe57:4e05]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60FE110E for ; Tue, 1 Aug 2023 10:58:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description; bh=TwC+F4ydhuXrkNHt7b/Hhr/+kOh8ohhvIWctCDUtK4I=; b=Qt3rCsA30DX1+kbWhXQ0fonYeF PXmKfajm5KBjMLscB8oG3R8cVxMWcADrOWWkGTiHnLZejcLIJJcgq1Aq8dVhMomEfIqS5rgq55/pD o24Dl03ege34a3xAcB/7e7aQx1iXtEVdQazQrWfHqCDHazEMs5svrdwKbLiol1BOOpKtmBR3EcytZ QUcEZvW3qMJW0o1iJ+MrxgAXByT9m15kDY8+yw9JrUJHy+y8AKog/QINKcliBCIdAfH+1FPgD+s+1 l0K4ELAa74rrQZBdH7tHPvFxW7vDDpsb7iKf5pq9tGcOtz4RB4PeTbfoVjJq+Yq54vLiljKzIe7Pc Wsbfpfww==; Received: from [2001:8b0:10b:1::ebe] (helo=i7.infradead.org) by desiato.infradead.org with esmtpsa (Exim 4.96 #2 (Red Hat Linux)) id 1qQtd2-00EpEN-0q; Tue, 01 Aug 2023 17:57:52 +0000 Received: from dwoodhou by i7.infradead.org with local (Exim 4.96 #2 (Red Hat Linux)) id 1qQtcz-000bxj-1V; Tue, 01 Aug 2023 18:57:49 +0100 From: David Woodhouse To: qemu-devel@nongnu.org Cc: Paul Durrant , Paolo Bonzini , Richard Henderson , Eduardo Habkost , "Michael S. Tsirkin" , Marcel Apfelbaum , Marcelo Tosatti , kvm@vger.kernel.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud?= =?utf-8?q?=C3=A9?= , Anthony PERARD , David Woodhouse Subject: [PATCH for-8.1 2/3] i386/xen: consistent locking around Xen singleshot timers Date: Tue, 1 Aug 2023 18:57:46 +0100 Message-Id: <20230801175747.145906-3-dwmw2@infradead.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230801175747.145906-1-dwmw2@infradead.org> References: <20230801175747.145906-1-dwmw2@infradead.org> MIME-Version: 1.0 Sender: David Woodhouse X-SRS-Rewrite: SMTP reverse-path rewritten from by desiato.infradead.org. See http://www.infradead.org/rpr.html Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: David Woodhouse Coverity points out (CID 1507534, 1507968) that we sometimes access env->xen_singleshot_timer_ns under the protection of env->xen_timers_lock and sometimes not. This isn't always an issue. There are two modes for the timers; if the kernel supports the EVTCHN_SEND capability then it handles all the timer hypercalls and delivery internally, and all we use the field for is to get/set the timer as part of the vCPU state via an ioctl(). If the kernel doesn't have that support, then we do all the emulation within qemu, and *those* are the code paths where we actually care about the locking. But it doesn't hurt to be a little bit more consistent and avoid having to explain *why* it's OK. Signed-off-by: David Woodhouse Reviewed-by: Paul Durrant --- target/i386/kvm/xen-emu.c | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-) diff --git a/target/i386/kvm/xen-emu.c b/target/i386/kvm/xen-emu.c index d7c7eb8d9c..9946ff0905 100644 --- a/target/i386/kvm/xen-emu.c +++ b/target/i386/kvm/xen-emu.c @@ -43,6 +43,7 @@ static void xen_vcpu_singleshot_timer_event(void *opaque); static void xen_vcpu_periodic_timer_event(void *opaque); +static int vcpuop_stop_singleshot_timer(CPUState *cs); #ifdef TARGET_X86_64 #define hypercall_compat32(longmode) (!(longmode)) @@ -466,6 +467,7 @@ void kvm_xen_inject_vcpu_callback_vector(uint32_t vcpu_id, int type) } } +/* Must always be called with xen_timers_lock held */ static int kvm_xen_set_vcpu_timer(CPUState *cs) { X86CPU *cpu = X86_CPU(cs); @@ -483,6 +485,7 @@ static int kvm_xen_set_vcpu_timer(CPUState *cs) static void do_set_vcpu_timer_virq(CPUState *cs, run_on_cpu_data data) { + QEMU_LOCK_GUARD(&X86_CPU(cs)->env.xen_timers_lock); kvm_xen_set_vcpu_timer(cs); } @@ -545,7 +548,6 @@ static void do_vcpu_soft_reset(CPUState *cs, run_on_cpu_data data) env->xen_vcpu_time_info_gpa = INVALID_GPA; env->xen_vcpu_runstate_gpa = INVALID_GPA; env->xen_vcpu_callback_vector = 0; - env->xen_singleshot_timer_ns = 0; memset(env->xen_virq, 0, sizeof(env->xen_virq)); set_vcpu_info(cs, INVALID_GPA); @@ -555,8 +557,13 @@ static void do_vcpu_soft_reset(CPUState *cs, run_on_cpu_data data) INVALID_GPA); if (kvm_xen_has_cap(EVTCHN_SEND)) { kvm_xen_set_vcpu_callback_vector(cs); + + QEMU_LOCK_GUARD(&X86_CPU(cs)->env.xen_timers_lock); + env->xen_singleshot_timer_ns = 0; kvm_xen_set_vcpu_timer(cs); - } + } else { + vcpuop_stop_singleshot_timer(cs); + }; } @@ -1059,6 +1066,10 @@ static int vcpuop_stop_periodic_timer(CPUState *target) return 0; } +/* + * Userspace handling of timer, for older kernels. + * Must always be called with xen_timers_lock held. + */ static int do_set_singleshot_timer(CPUState *cs, uint64_t timeout_abs, bool future, bool linux_wa) { @@ -1086,12 +1097,8 @@ static int do_set_singleshot_timer(CPUState *cs, uint64_t timeout_abs, timeout_abs = now + delta; } - qemu_mutex_lock(&env->xen_timers_lock); - timer_mod_ns(env->xen_singleshot_timer, qemu_now + delta); env->xen_singleshot_timer_ns = now + delta; - - qemu_mutex_unlock(&env->xen_timers_lock); return 0; } @@ -1115,6 +1122,7 @@ static int vcpuop_set_singleshot_timer(CPUState *cs, uint64_t arg) return -EFAULT; } + QEMU_LOCK_GUARD(&X86_CPU(cs)->env.xen_timers_lock); return do_set_singleshot_timer(cs, sst.timeout_abs_ns, !!(sst.flags & VCPU_SSHOTTMR_future), false); @@ -1141,6 +1149,7 @@ static bool kvm_xen_hcall_set_timer_op(struct kvm_xen_exit *exit, X86CPU *cpu, if (unlikely(timeout == 0)) { err = vcpuop_stop_singleshot_timer(CPU(cpu)); } else { + QEMU_LOCK_GUARD(&X86_CPU(cpu)->env.xen_timers_lock); err = do_set_singleshot_timer(CPU(cpu), timeout, false, true); } exit->u.hcall.result = err; @@ -1826,6 +1835,7 @@ int kvm_put_xen_state(CPUState *cs) * If the kernel has EVTCHN_SEND support then it handles timers too, * so the timer will be restored by kvm_xen_set_vcpu_timer() below. */ + QEMU_LOCK_GUARD(&env->xen_timers_lock); if (env->xen_singleshot_timer_ns) { ret = do_set_singleshot_timer(cs, env->xen_singleshot_timer_ns, false, false); @@ -1844,10 +1854,7 @@ int kvm_put_xen_state(CPUState *cs) } if (env->xen_virq[VIRQ_TIMER]) { - ret = kvm_xen_set_vcpu_timer(cs); - if (ret < 0) { - return ret; - } + do_set_vcpu_timer_virq(cs, RUN_ON_CPU_HOST_INT(env->xen_virq[VIRQ_TIMER])); } return 0; } @@ -1896,6 +1903,15 @@ int kvm_get_xen_state(CPUState *cs) if (ret < 0) { return ret; } + + /* + * This locking is fairly pointless, and is here to appease Coverity. + * There is an unavoidable race condition if a different vCPU sets a + * timer for this vCPU after the value has been read out. But that's + * OK in practice because *all* the vCPUs need to be stopped before + * we set about migrating their state. + */ + QEMU_LOCK_GUARD(&X86_CPU(cs)->env.xen_timers_lock); env->xen_singleshot_timer_ns = va.u.timer.expires_ns; } From patchwork Tue Aug 1 17:57:47 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Woodhouse X-Patchwork-Id: 13337135 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 458EFC04A94 for ; Tue, 1 Aug 2023 17:58:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232255AbjHAR60 (ORCPT ); Tue, 1 Aug 2023 13:58:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53380 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233283AbjHAR6K (ORCPT ); Tue, 1 Aug 2023 13:58:10 -0400 Received: from desiato.infradead.org (desiato.infradead.org [IPv6:2001:8b0:10b:1:d65d:64ff:fe57:4e05]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28E6219A0 for ; Tue, 1 Aug 2023 10:58:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description; bh=rfKodFpuUvMf8xRxS1F9RNhEDLvbGFAcnQWQWwOY7tc=; b=d0gSji5iVq/dhOJJq3mlDgWSEF W5CC2OZsHD5r1nN/ukFweI2QrtYfk2hzeZjq/QRMRjjgKAK7cAUf8KHvrZFUSWWqui9CyVhnYQESN bPy6J3vGoLulgVnlgFHsGq+x/AKzbGDYb34LdIga8k+r4wWjewLB1xKdyFel0oaIdUTeXKCIvBy32 G5+y5hUkXxR8myGfDLsB+dVjhpibxSdZ62cJYUmt5KVjfBF1zYWGSiVPYyV8CeslqdPDHNgmGh9WB hJM/lm4ffbZXEte6WV8JatCGMRK0IsSMHRXZhHI/vQGiXbplfwvNtkOb7cKh79jLZYyyKyZ+mIwBQ IoOo+dzA==; Received: from [2001:8b0:10b:1::ebe] (helo=i7.infradead.org) by desiato.infradead.org with esmtpsa (Exim 4.96 #2 (Red Hat Linux)) id 1qQtd2-00EpEM-0s; Tue, 01 Aug 2023 17:57:52 +0000 Received: from dwoodhou by i7.infradead.org with local (Exim 4.96 #2 (Red Hat Linux)) id 1qQtcz-000bxm-1j; Tue, 01 Aug 2023 18:57:49 +0100 From: David Woodhouse To: qemu-devel@nongnu.org Cc: Paul Durrant , Paolo Bonzini , Richard Henderson , Eduardo Habkost , "Michael S. Tsirkin" , Marcel Apfelbaum , Marcelo Tosatti , kvm@vger.kernel.org, Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud?= =?utf-8?q?=C3=A9?= , Anthony PERARD , David Woodhouse Subject: [PATCH for-8.1 3/3] hw/xen: prevent guest from binding loopback event channel to itself Date: Tue, 1 Aug 2023 18:57:47 +0100 Message-Id: <20230801175747.145906-4-dwmw2@infradead.org> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230801175747.145906-1-dwmw2@infradead.org> References: <20230801175747.145906-1-dwmw2@infradead.org> MIME-Version: 1.0 Sender: David Woodhouse X-SRS-Rewrite: SMTP reverse-path rewritten from by desiato.infradead.org. See http://www.infradead.org/rpr.html Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: David Woodhouse Fuzzing showed that a guest could bind an interdomain port to itself, by guessing the next port to be allocated and putting that as the 'remote' port number. By chance, that works because the newly-allocated port has type EVTCHNSTAT_unbound. It shouldn't. Signed-off-by: David Woodhouse Reviewed-by: Paul Durrant --- hw/i386/kvm/xen_evtchn.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c index 0e9c108614..a731738411 100644 --- a/hw/i386/kvm/xen_evtchn.c +++ b/hw/i386/kvm/xen_evtchn.c @@ -1408,8 +1408,15 @@ int xen_evtchn_bind_interdomain_op(struct evtchn_bind_interdomain *interdomain) XenEvtchnPort *rp = &s->port_table[interdomain->remote_port]; XenEvtchnPort *lp = &s->port_table[interdomain->local_port]; - if (rp->type == EVTCHNSTAT_unbound && rp->type_val == 0) { - /* It's a match! */ + /* + * The 'remote' port for loopback must be an unbound port allocated for + * communication with the local domain (as indicated by rp->type_val + * being zero, not PORT_INFO_TYPEVAL_REMOTE_QEMU), and must *not* be + * the port that was just allocated for the local end. + */ + if (interdomain->local_port != interdomain->remote_port && + rp->type == EVTCHNSTAT_unbound && rp->type_val == 0) { + rp->type = EVTCHNSTAT_interdomain; rp->type_val = interdomain->local_port;