lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Tue,  5 Oct 2021 14:14:21 +0200
From:   David Hildenbrand <>
Cc:     David Hildenbrand <>,
        Andrew Morton <>,
        Thomas Gleixner <>,
        Ingo Molnar <>, Borislav Petkov <>,
        "H. Peter Anvin" <>,
        Boris Ostrovsky <>,
        Juergen Gross <>,
        Stefano Stabellini <>,
        "Michael S. Tsirkin" <>,
        Jason Wang <>,
        Dave Young <>, Baoquan He <>,
        Vivek Goyal <>,
        Michal Hocko <>,
        Oscar Salvador <>,
        Mike Rapoport <>,
        "Rafael J. Wysocki" <>,,,,,,
Subject: [PATCH v2 0/9] proc/vmcore: sanitize access to virtio-mem memory

As so often with virtio-mem changes that mess with common MM
infrastructure, this might be a good candiate to go via Andrew's tree.


After removing /dev/kmem, sanitizing /proc/kcore and handling /dev/mem,
this series tackles the last sane way how a VM could accidentially access
logically unplugged memory managed by a virtio-mem device: /proc/vmcore

When dumping memory via "makedumpfile", PG_offline pages, used by
virtio-mem to flag logically unplugged memory, are already properly
excluded; however, especially when accessing/copying /proc/vmcore "the
usual way", we can still end up reading logically unplugged memory part of
a virtio-mem device.

Patch #1-#3 are cleanups. Patch #4 extends the existing oldmem_pfn_is_ram
mechanism. Patch #5-#7 are virtio-mem refactorings for patch #8, which
implements the virtio-mem logic to query the state of device blocks.

Patch #8:

Although virtio-mem currently supports reading unplugged memory in the
hypervisor, this will change in the future, indicated to the device via
a new feature flag. We similarly sanitized /proc/kcore access recently.
Distributions that support virtio-mem+kdump have to make sure that the
virtio_mem module will be part of the kdump kernel or the kdump initrd;
dracut was recently [2] extended to include virtio-mem in the generated
initrd. As long as no special kdump kernels are used, this will
automatically make sure that virtio-mem will be around in the kdump initrd
and sanitize /proc/vmcore access -- with dracut.

This is the last remaining bit to support
VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE [3] in the Linux implementation of

Note: this is best-effort. We'll never be able to control what runs inside
the second kernel, really, but we also don't have to care: we only care
about sane setups where we don't want our VM getting zapped once we
touch the wrong memory location while dumping. While we usually expect sane
setups to use "makedumfile", nothing really speaks against just copying
/proc/vmcore, especially in environments where HWpoisioning isn't typically
expected. Also, we really don't want to put all our trust completely on the
memmap, so sanitizing also makes sense when just using "makedumpfile".


v1 -> v2:
- "x86/xen: simplify xen_oldmem_pfn_is_ram()"
-- Simplify even more
- "x86/xen: print a warning when HVMOP_get_mem_type fails"
-- Added
- "virtio-mem: kdump mode to sanitize /proc/vmcore access"
-- Fix wrong range check

Cc: Andrew Morton <>
Cc: Thomas Gleixner <>
Cc: Ingo Molnar <>
Cc: Borislav Petkov <>
Cc: "H. Peter Anvin" <>
Cc: Boris Ostrovsky <>
Cc: Juergen Gross <>
Cc: Stefano Stabellini <>
Cc: "Michael S. Tsirkin" <>
Cc: Jason Wang <>
Cc: Dave Young <>
Cc: Baoquan He <>
Cc: Vivek Goyal <>
Cc: Michal Hocko <>
Cc: Oscar Salvador <>
Cc: Mike Rapoport <>
Cc: "Rafael J. Wysocki" <>

David Hildenbrand (9):
  x86/xen: update xen_oldmem_pfn_is_ram() documentation
  x86/xen: simplify xen_oldmem_pfn_is_ram()
  x86/xen: print a warning when HVMOP_get_mem_type fails
  proc/vmcore: let pfn_is_ram() return a bool
  proc/vmcore: convert oldmem_pfn_is_ram callback to more generic vmcore
  virtio-mem: factor out hotplug specifics from virtio_mem_init() into
  virtio-mem: factor out hotplug specifics from virtio_mem_probe() into
  virtio-mem: factor out hotplug specifics from virtio_mem_remove() into
  virtio-mem: kdump mode to sanitize /proc/vmcore access

 arch/x86/kernel/aperture_64.c |  13 +-
 arch/x86/xen/mmu_hvm.c        |  37 ++---
 drivers/virtio/virtio_mem.c   | 297 ++++++++++++++++++++++++----------
 fs/proc/vmcore.c              | 105 ++++++++----
 include/linux/crash_dump.h    |  26 ++-
 5 files changed, 333 insertions(+), 145 deletions(-)

base-commit: 9e1ff307c779ce1f0f810c7ecce3d95bbae40896

Powered by blists - more mailing lists