linux-kernel - Re: [PATCH RESEND] KVM: X86: Fix stack-out-of-bounds read in write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 13 Dec 2017 10:56:57 +0100
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Wanpeng Li <kernellwp@...il.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        kvm <kvm@...r.kernel.org>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Wanpeng Li <wanpeng.li@...mail.com>
Subject: Re: [PATCH RESEND] KVM: X86: Fix stack-out-of-bounds read in
 write_mmio

On 13/12/2017 04:05, Wanpeng Li wrote:
> 2017-12-13 0:07 GMT+08:00 Paolo Bonzini <pbonzini@...hat.com>:
>> On 12/12/2017 09:57, Wanpeng Li wrote:
>>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>>> index bc5d853..51e7932 100644
>>> --- a/arch/x86/kvm/x86.c
>>> +++ b/arch/x86/kvm/x86.c
>>> @@ -4690,7 +4690,10 @@ static int write_emulate(struct kvm_vcpu *vcpu, gpa_t gpa,
>>>
>>>  static int write_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes, void *val)
>>>  {
>>> -     trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, *(u64 *)val);
>>> +     u64 data = 0;
>>> +
>>> +     memcpy(&data, val, min(8, bytes));
>>> +     trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, data);
>>>       return vcpu_mmio_write(vcpu, gpa, bytes, val);
>>>  }
>>>
>>>
>>
>> Please do the memcpy in TRACE_EVENT(kvm_mmio)'s TP_fast_assign block.
>> That is done only when the trace event is active.
> 
> I still can observe the stack out-of-bounds read warning if keep *(u64
> *)val as the parameter since it has already been dereferenced. So
> maybe we should change the parameter of trace_kvm_mmio() to void *val,

Yes, exactly.

> however, I'm not sure whether it will break the tracepoint ABI which
> this article https://lwn.net/Articles/734039/ "Workload analysis with
> tracing" section pointed out.

No, the tracepoint ABI refers to TP_PROTO, not TP_STRUCT and
TP_fast_assign.  Good that you thought about it, though!

Thanks,

Paolo