linux-kernel - Re: [PATCH] x86/paravirt: Guard against invalid cpu # in pv_vcpu_is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 25 Mar 2019 17:40:46 +0100
From:   Juergen Gross <jgross@...e.com>
To:     Waiman Long <longman@...hat.com>,
        Alok Kataria <akataria@...are.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Will Deacon <will.deacon@....com>
Cc:     x86@...nel.org, linux-kernel@...r.kernel.org,
        virtualization@...ts.linux-foundation.org,
        Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: [PATCH] x86/paravirt: Guard against invalid cpu # in
 pv_vcpu_is_preempted()

On 25/03/2019 16:57, Waiman Long wrote:
> It was found that passing an invalid cpu number to pv_vcpu_is_preempted()
> might panic the kernel in a VM guest. For example,
> 
> [    2.531077] Oops: 0000 [#1] SMP PTI
>   :
> [    2.532545] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
> [    2.533321] RIP: 0010:__raw_callee_save___kvm_vcpu_is_preempted+0x0/0x20
> 
> To guard against this kind of kernel panic, check is added to
> pv_vcpu_is_preempted() to make sure that no invalid cpu number will
> be used.
> 
> Signed-off-by: Waiman Long <longman@...hat.com>
> ---
>  arch/x86/include/asm/paravirt.h | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
> index c25c38a05c1c..4cfb465dcde4 100644
> --- a/arch/x86/include/asm/paravirt.h
> +++ b/arch/x86/include/asm/paravirt.h
> @@ -671,6 +671,12 @@ static __always_inline void pv_kick(int cpu)
>  
>  static __always_inline bool pv_vcpu_is_preempted(long cpu)
>  {
> +	/*
> +	 * Guard against invalid cpu number or the kernel might panic.
> +	 */
> +	if (WARN_ON_ONCE((unsigned long)cpu >= nr_cpu_ids))
> +		return false;
> +
>  	return PVOP_CALLEE1(bool, lock.vcpu_is_preempted, cpu);
>  }

Can this really happen without being a programming error?

Basically you'd need to guard all percpu area accesses to foreign cpus
this way. Why is this one special?


Juergen