lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 24 Mar 2020 12:30:37 +0100 From: Paolo Bonzini <pbonzini@...hat.com> To: Sean Christopherson <sean.j.christopherson@...el.com>, Christian Borntraeger <borntraeger@...ibm.com>, Janosch Frank <frankja@...ux.ibm.com> Cc: David Hildenbrand <david@...hat.com>, Cornelia Huck <cohuck@...hat.com>, kvm@...r.kernel.org, linux-kernel@...r.kernel.org, Qian Cai <cai@....pw>, Peter Xu <peterx@...hat.com> Subject: Re: [PATCH 0/7] KVM: Fix memslot use-after-free bug On 20/03/20 21:55, Sean Christopherson wrote: > Fix a bug introduced by dynamic memslot allocation where the LRU slot can > become invalid and lead to a out-of-bounds/use-after-free scenario. > > The patch is different that what Qian has already tested, but I was able > to reproduce the bad behavior by enhancing the set memory region selftest, > i.e. I'm relatively confident the bug is fixed. > > Patches 2-6 are a variety of selftest cleanup, with the aforementioned > set memory region enhancement coming in patch 7. > > Note, I couldn't get the selftest to fail outright or with KASAN, but was > able to hit a WARN_ON an invalid slot 100% of the time (without the fix, > obviously). > > Regarding s390, I played around a bit with merging gfn_to_memslot_approx() > into search_memslots(). Code wise it's trivial since they're basically > identical, but doing so increases the code footprint of search_memslots() > on x86 by 30 bytes, so I ended up abandoning the effort. > > Sean Christopherson (7): > KVM: Fix out of range accesses to memslots > KVM: selftests: Fix cosmetic copy-paste error in vm_mem_region_move() > KVM: selftests: Take vcpu pointer instead of id in vm_vcpu_rm() > KVM: selftests: Add helpers to consolidate open coded list operations > KVM: selftests: Add util to delete memory region > KVM: selftests: Expose the primary memslot number to tests > KVM: selftests: Add "delete" testcase to set_memory_region_test > > arch/s390/kvm/kvm-s390.c | 3 + > include/linux/kvm_host.h | 3 + > .../testing/selftests/kvm/include/kvm_util.h | 3 + > tools/testing/selftests/kvm/lib/kvm_util.c | 139 ++++++++++-------- > .../kvm/x86_64/set_memory_region_test.c | 122 +++++++++++++-- > virt/kvm/kvm_main.c | 3 + > 6 files changed, 201 insertions(+), 72 deletions(-) > Queued patches 1-3, thanks. Paolo
Powered by blists - more mailing lists