linux-kernel - Re: [PATCH] kvm: Ensure writes to the coalesced MMIO ring are within bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Sep 2019 14:59:33 +0100
From:   Will Deacon <will@...nel.org>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     kvm@...r.kernel.org, kernellwp@...il.com,
        linux-kernel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "# 5 . 2 . y" <stable@...nel.org>
Subject: Re: [PATCH] kvm: Ensure writes to the coalesced MMIO ring are within
 bounds

On Wed, Sep 18, 2019 at 03:41:40PM +0200, Paolo Bonzini wrote:
> On 18/09/19 15:15, Will Deacon wrote:
> > When records are written to the coalesced MMIO ring in response to a
> > vCPU MMIO exit, the 'ring->last' field is used to index the ring buffer
> > page. Although we hold the 'kvm->ring_lock' at this point, the ring
> > structure is mapped directly into the host userspace and can therefore
> > be modified to point at arbitrary pages within the kernel.
> > 
> > Since this shouldn't happen in normal operation, simply bound the index
> > by KVM_COALESCED_MMIO_MAX to contain the accesses within the ring buffer
> > page.
> > 
> > Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> > Cc: Paolo Bonzini <pbonzini@...hat.com>
> > Cc: <stable@...nel.org> # 5.2.y
> > Fixes: 5f94c1741bdc ("KVM: Add coalesced MMIO support (common part)")
> > Reported-by: Bill Creasey <bcreasey@...gle.com>
> > Signed-off-by: Will Deacon <will@...nel.org>
> > ---
> > 
> > I think there are some other fixes kicking around for this, but they
> > still rely on 'ring->last' being stable, which isn't necessarily the
> > case. I'll send the -stable backport for kernels prior to 5.2 once this
> > hits mainline.
> 
> Google's patch, which checks if ring->last is not in range and fails
> with -EOPNOTSUPP if not, is slightly better.  I'll send it in a second
> and Cc you (and also send it as a pull request to Linus).

Okey doke, as long as it gets fixed! My minor concerns with the error-checking
variant are:

  * Whether or not you need a READ_ONCE to prevent the compiler potentially
    reloading 'ring->last' after validation

  * Whether or not this could be part of a spectre-v1 gadget

so, given that I don't think the malicious host deserves an error code if it
starts writing the 'last' index, I went with the "obviously safe" version.
But up to you.

Will