linux-kernel - Re: Re: [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Dec 2017 14:51:17 +0800
From:   Lan Tianyu <tianyu.lan@...el.com>
To:     Wanpeng Li <kernellwp@...il.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krcmar <rkrcmar@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        the arch/x86 maintainers <x86@...nel.org>,
        kvm <kvm@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Jim Mattson <jmattson@...gle.com>
Subject: Re: Re: [PATCH] KVM/Emulate: Mask linear address with actual address
 width in order to avoid conflict with UNMAPPED_GVA

On 2017年12月12日 14:42, Wanpeng Li wrote:
> 2017-12-12 7:23 GMT+08:00 Lan Tianyu <tianyu.lan@...el.com>:
>>
>> Reported by syzkaller:
>>     WARNING: CPU: 0 PID: 27962 at arch/x86/kvm/emulate.c:5631 x86_emulate_insn+0x557/0x15f0 [kvm]
>>     Modules linked in: kvm_intel kvm [last unloaded: kvm]
>>     CPU: 0 PID: 27962 Comm: syz-executor Tainted: G    B   W        4.15.0-rc2-next-20171208+ #32
>>     Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.01.03.0006.040720161253 04/07/2016
>>     RIP: 0010:x86_emulate_insn+0x557/0x15f0 [kvm]
>>     RSP: 0018:ffff8807234476d0 EFLAGS: 00010282
>>     RAX: 0000000000000000 RBX: ffff88072d0237a0 RCX: ffffffffa0065c4d
>>     RDX: 1ffff100e5a046f9 RSI: 0000000000000003 RDI: ffff88072d0237c8
>>     RBP: ffff880723447728 R08: ffff88072d020000 R09: ffffffffa008d240
>>     R10: 0000000000000002 R11: ffffed00e7d87db3 R12: ffff88072d0237c8
>>     R13: ffff88072d023870 R14: ffff88072d0238c2 R15: ffffffffa008d080
>>     FS:  00007f8a68666700(0000) GS:ffff880802200000(0000) knlGS:0000000000000000
>>     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>     CR2: 000000002009506c CR3: 000000071fec4005 CR4: 00000000003626f0
>>     Call Trace:
>>      x86_emulate_instruction+0x3bc/0xb70 [kvm]
>>      ? reexecute_instruction.part.162+0x130/0x130 [kvm]
>>      vmx_handle_exit+0x46d/0x14f0 [kvm_intel]
>>      ? trace_event_raw_event_kvm_entry+0xe7/0x150 [kvm]
>>      ? handle_vmfunc+0x2f0/0x2f0 [kvm_intel]
>>      ? wait_lapic_expire+0x25/0x270 [kvm]
>>      vcpu_enter_guest+0x720/0x1ef0 [kvm]
>>      ...
>>
>> Syzkaller tests KVM emulation code path with setting RSP 0xffffffffffffffff
>> and running in 64bit non paging mode. It triggers warning that exception
>> vector is > 1f(it's initialized to be 0xff in x86_emulate_instruction())
>> during emulation of pop instruction. This is due to pop emulation callback
>> em_pop() returns X86EMUL_PROPAGATE_FAULT while not populate exception
>> vector. POP emulation code accesses RSP with linear address
>> 0xffffffffffffffff and KVM mmu returns GVA as GPA during nonpaging mode.
>> In this case, GPA 0xffffffffffffffff(~0) conflicts with error code
>> UNMAPPED_GVA which is defined to be (~(u64)0). Caller vcpu_mmio_gva_to
>> _gpa() treats the return address as error and this also causes emulator
>> _read_write_onepage() returns X86EMUL_PROPAGATE_FAULT without a validated
>> exception vector.
>>
>> This patch is to mask linear address with address width to fix such issue
>> since linear address won't occupy all 64-bit even if in 5 level paging
>> mode.
>>
>> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
>> Cc: Paolo Bonzini <pbonzini@...hat.com>
>> Cc: Radim Krčmář <rkrcmar@...hat.com>
>> Cc: Dmitry Vyukov <dvyukov@...gle.com>
>> Cc: Jim Mattson <jmattson@...gle.com>
>> Cc: Wanpeng Li <kernellwp@...il.com>
>> Signed-off-by: Lan Tianyu <tianyu.lan@...el.com>
> 
> Tested-by: Wanpeng Li <wanpeng.li@...mail.com>
> 

Thanks a lot.

-- 
Best regards
Tianyu Lan