linux-kernel - Re: [PATCH v2] KVM: fix overflow of zero page refcount with ksm running

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5edb3631-090a-4601-9784-6f70b8df5417@kylinos.cn>
Date:   Thu, 16 Nov 2023 15:47:40 +0800
From:   Kunwu Chan <chentao@...inos.cn>
To:     ann.zhuangyanying@...wei.com
Cc:     pbonzini@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] KVM: fix overflow of zero page refcount with ksm
 running

Hi Yanying,
Is there a specific reproduction step? On the platform of the x86_64, I 
followed the steps given, and there was no reproduction.

The specific steps are as follows:
1. Compile the kernel of the 4.19 stable version on the host (remove the 
judgment of "&&is_zero_pfn!(pfn)" in the function 'kvm_is_reserved_pfn' 
to ensure that it is the same as before the patch was modified); Set 
'CONFIG_DEVMEM', not 'CONFIG_STRICT_DEVMEM', please refer to the 
attachment for specific configurations.
2. After the replacement kernel is restarted, turn on the setting 'ksm' 
as the original submission.
3. Create two ubuntu-22.04 virtual machines, and run 'cat /dev/mem' with 
'root' in the virtual machine, and the error "not allowed operation" 
will be reported after printing a piece of memory.

I don't know if this error is causing me not to reproduce it.

Debugging methods tried:
1. Add 'zero page' to the function 'follow_page_pte' to judge and print 
'refcount',the same in 'wp_page_copy', 'ptr' keeps changing, 'refcount' 
doesn't accumulate, I don't understand what the situation is.

if(is_zero_pfn(page_to_pfn(page))){
                 pr_info("follow_page_pte zero page pfn[%u] ptr[%p] 
page->refcount [%d]n", pfn, page, page->_refcount);
                 WARN_ON(1);
}

log like:
Nov 14 15:51:13 localhost kernel: [  355.498656] follow_page_pte zero 
page alloc page succ pfn[15653012] ptr[00000000206319d5] page->refcount [1]
Nov 14 15:51:13 localhost kernel: [  355.498706] follow_page_pte zero 
page alloc page succ pfn[15653012] ptr[00000000206319d5] page->refcount [1]
Nov 14 15:51:13 localhost kernel: [  355.498758] follow_page_pte zero 
page alloc page succ pfn[15653012] ptr[00000000206319d5] page->refcount [1]

2. Add similar print logs to 'get_page', 'mmu_set_spte', 
'do_anonymous_page', 'kvm_vcpu_fault', and the result is the same, 
'refcount' does not accumulate as expected.

3. I don't see the decreasing 'refcount' in the 'kvm_release_pfn_clean' 
function.

Thanks
View attachment "4.19.298+.config" of type "text/plain" (198981 bytes)