lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CANRm+CwLmY7R6oB=Ah-+sof7XW9eo2kkv5kmrbjxJJfisnovog@mail.gmail.com> Date: Wed, 13 Dec 2017 11:05:31 +0800 From: Wanpeng Li <kernellwp@...il.com> To: Paolo Bonzini <pbonzini@...hat.com> Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, kvm <kvm@...r.kernel.org>, Radim Krčmář <rkrcmar@...hat.com>, Wanpeng Li <wanpeng.li@...mail.com> Subject: Re: [PATCH RESEND] KVM: X86: Fix stack-out-of-bounds read in write_mmio 2017-12-13 0:07 GMT+08:00 Paolo Bonzini <pbonzini@...hat.com>: > On 12/12/2017 09:57, Wanpeng Li wrote: >> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c >> index bc5d853..51e7932 100644 >> --- a/arch/x86/kvm/x86.c >> +++ b/arch/x86/kvm/x86.c >> @@ -4690,7 +4690,10 @@ static int write_emulate(struct kvm_vcpu *vcpu, gpa_t gpa, >> >> static int write_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes, void *val) >> { >> - trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, *(u64 *)val); >> + u64 data = 0; >> + >> + memcpy(&data, val, min(8, bytes)); >> + trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, data); >> return vcpu_mmio_write(vcpu, gpa, bytes, val); >> } >> >> > > Please do the memcpy in TRACE_EVENT(kvm_mmio)'s TP_fast_assign block. > That is done only when the trace event is active. I still can observe the stack out-of-bounds read warning if keep *(u64 *)val as the parameter since it has already been dereferenced. So maybe we should change the parameter of trace_kvm_mmio() to void *val, however, I'm not sure whether it will break the tracepoint ABI which this article https://lwn.net/Articles/734039/ "Workload analysis with tracing" section pointed out. Regards, Wanpeng Li
Powered by blists - more mailing lists