linux-kernel - Re: KVM: Warn if mark_page_dirty() is called without an active vCPU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ee872549432eaf62c0c5a722b94ac4390ef3df83.camel@infradead.org>
Date:   Mon, 22 Nov 2021 17:52:58 +0000
From:   David Woodhouse <dwmw2@...radead.org>
To:     Sean Christopherson <seanjc@...gle.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        butt3rflyh4ck <butterflyhuangxx@...il.com>, kvm@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: KVM: Warn if mark_page_dirty() is called without an active vCPU

On Mon, 2021-11-22 at 17:01 +0000, Sean Christopherson wrote:
> On Sat, Nov 20, 2021, David Woodhouse wrote:
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index 6c5083f2eb50..72c6453bcef4 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -3020,12 +3020,17 @@ void mark_page_dirty_in_slot(struct kvm *kvm,
> >  			     struct kvm_memory_slot *memslot,
> >  		 	     gfn_t gfn)
> >  {
> > +	struct kvm_vcpu *vcpu = kvm_get_running_vcpu();
> > +
> > +	if (WARN_ON_ONCE(!vcpu) || WARN_ON_ONCE(vcpu->kvm != kvm))
> 
> Maybe use KVM_BUG_ON?  And two separate WARNs are probably overkill.
> 
> 	if (KVM_BUG_ON(!vcpu || vcpu->kvm != kvm, kvm))
> 
> 
> I'd also prefer to not retrieve the vCPU in the dirty_bitmap path, at least not
> until it's necessary (for the proposed dirty quota throttling), though that's not
> a strong preference.

I don't think that would achieve my objective. This was my reaction to
learning that I was never supposed to have called kvm_write_guest()
when I didn't have an active vCPU context¹. I wanted there to have been
a *warning* about that, right there and then when I first did it
instead of waiting for syzkaller to find it.

I didn't want to wait for the actual circumstances to arise that made
it *crash*; I wanted an early warning. And that's also why it was a
warning not a BUG(), but I suppose KVM_BUG_ON() would be OK.

-- 
dwmw2

¹ My other reaction was wanting to remove kvm_write_guest() entirely
  and let people use kvm_vcpu_write_guest() instead. That's the path I 
  was going down with the original patch to propagate the vcpu down.

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5174 bytes)