linux-kernel - Re: [PATCH 3/3] KVM: x86: Explicitly zero kvm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 24 Apr 2024 03:25:45 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "pbonzini@...hat.com" <pbonzini@...hat.com>, "seanjc@...gle.com"
	<seanjc@...gle.com>
CC: "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 3/3] KVM: x86: Explicitly zero kvm_caps during vendor
 module load

On Tue, 2024-04-23 at 09:53 -0700, Sean Christopherson wrote:
> Zero out all of kvm_caps when loading a new vendor module to ensure that
> KVM can't inadvertently rely on global initialization of a field, and add
> a comment above the definition of kvm_caps to call out that all fields
> needs to be explicitly computed during vendor module load.
> 
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> ---
>  arch/x86/kvm/x86.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 44ce187bad89..8f3979d5fc80 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -92,6 +92,11 @@
>  #define MAX_IO_MSRS 256
>  #define KVM_MAX_MCE_BANKS 32
>  
> +/*
> + * Note, kvm_caps fields should *never* have default values, all fields must be
> + * recomputed from scratch during vendor module load, e.g. to account for a
> + * vendor module being reloaded with different module parameters.
> + */
>  struct kvm_caps kvm_caps __read_mostly;
>  EXPORT_SYMBOL_GPL(kvm_caps);
>  
> @@ -9755,6 +9760,8 @@ int kvm_x86_vendor_init(struct kvm_x86_init_ops *ops)
>  		return -EIO;
>  	}
>  
> +	memset(&kvm_caps, 0, sizeof(kvm_caps));
> +
>  	x86_emulator_cache = kvm_alloc_emulator_cache();
>  	if (!x86_emulator_cache) {
>  		pr_err("failed to allocate cache for x86 emulator\n");

Why do the memset() here particularly?

Isn't it better to put ...

	memset(&kvm_caps, 0, sizeof(kvm_caps));
	kvm_caps.supported_vm_types = BIT(KVM_X86_DEFAULT_VM);
	kvm_caps.supported_mce_cap = MCG_CTL_P | MCG_SER_P;

... together so it can be easily seen?

We can even have a helper to do above to "reset kvm_caps to default
values" I think.