linux-kernel - RE: [PATCH V2] x86/Hyper-V: Fix overflow issue in the fill_gva

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <DM5PR21MB01379A2DC17C13ABCFEE5E05D7BE0@DM5PR21MB0137.namprd21.prod.outlook.com>
Date:   Mon, 2 Sep 2019 14:40:26 +0000
From:   Michael Kelley <mikelley@...rosoft.com>
To:     "lantianyu1986@...il.com" <lantianyu1986@...il.com>,
        KY Srinivasan <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "sashal@...nel.org" <sashal@...nel.org>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>, "hpa@...or.com" <hpa@...or.com>,
        "x86@...nel.org" <x86@...nel.org>,
        "alex.williamson@...hat.com" <alex.williamson@...hat.com>,
        "cohuck@...hat.com" <cohuck@...hat.com>
CC:     Tianyu Lan <Tianyu.Lan@...rosoft.com>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>
Subject: RE: [PATCH V2] x86/Hyper-V: Fix overflow issue in the fill_gva_list()

From: Tianyu Lan <Tianyu.Lan@...rosoft.com> Sent: Monday, September 2, 2019 5:42 AM
> 
> When the 'start' parameter is >=  0xFF000000 on 32-bit
> systems, or >= 0xFFFFFFFF'FF000000 on 64-bit systems,
> fill_gva_list gets into an infinite loop.  With such inputs,
> 'cur' overflows after adding HV_TLB_FLUSH_UNIT and always
> compares as less than end.  Memory is filled with guest virtual
> addresses until the system crashes
> 
> Fix this by never incrementing 'cur' to be larger than 'end'.
> 
> Reported-by: Jong Hyun Park <park.jonghyun@...sei.ac.kr>
> Signed-off-by: Tianyu Lan <Tianyu.Lan@...rosoft.com>
> Fixes: 2ffd9e33ce4a ("x86/hyper-v: Use hypercall for remote TLB flush")
> ---
> Change since v1:
>      - Simply the commit message
> 
>  arch/x86/hyperv/mmu.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
> index e65d7fe6489f..5208ba49c89a 100644
> --- a/arch/x86/hyperv/mmu.c
> +++ b/arch/x86/hyperv/mmu.c
> @@ -37,12 +37,14 @@ static inline int fill_gva_list(u64 gva_list[], int offset,
>  		 * Lower 12 bits encode the number of additional
>  		 * pages to flush (in addition to the 'cur' page).
>  		 */
> -		if (diff >= HV_TLB_FLUSH_UNIT)
> +		if (diff >= HV_TLB_FLUSH_UNIT) {
>  			gva_list[gva_n] |= ~PAGE_MASK;
> -		else if (diff)
> +			cur += HV_TLB_FLUSH_UNIT;
> +		}  else if (diff) {
>  			gva_list[gva_n] |= (diff - 1) >> PAGE_SHIFT;
> +			cur = end;
> +		}
> 
> -		cur += HV_TLB_FLUSH_UNIT;
>  		gva_n++;
> 
>  	} while (cur < end);
> --
> 2.14.5

Reviewed-by: Michael Kelley <mikelley@...rosoft.com>