linux-kernel - Re: [PATCH 1/2] KVM: x86: Make x2APIC ID 100% readonly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1186d821-41ce-47c2-a7b2-70445816ed1c@redhat.com>
Date: Tue, 13 Aug 2024 18:01:26 +0200
From: Paolo Bonzini <pbonzini@...hat.com>
To: Sean Christopherson <seanjc@...gle.com>, Michal Luczaj <mhal@...x.co>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 Haoyu Wu <haoyuwu254@...il.com>,
 syzbot+545f1326f405db4e1c3e@...kaller.appspotmail.com
Subject: Re: [PATCH 1/2] KVM: x86: Make x2APIC ID 100% readonly

On 8/5/24 18:26, Sean Christopherson wrote:
> On Sun, Aug 04, 2024, Michal Luczaj wrote:
>> On 8/2/24 22:29, Sean Christopherson wrote:
>>> [...]
>>> Making the x2APIC ID fully readonly fixes a WARN in KVM's optimized map
>>> calculation, which expects the LDR to align with the x2APIC ID.
>>>
>>>    WARNING: CPU: 2 PID: 958 at arch/x86/kvm/lapic.c:331 kvm_recalculate_apic_map+0x609/0xa00 [kvm]
>>>    CPU: 2 PID: 958 Comm: recalc_apic_map Not tainted 6.4.0-rc3-vanilla+ #35
>>>    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.2-1-1 04/01/2014
>>>    RIP: 0010:kvm_recalculate_apic_map+0x609/0xa00 [kvm]
>>>    Call Trace:
>>>     <TASK>
>>>     kvm_apic_set_state+0x1cf/0x5b0 [kvm]
>>>     kvm_arch_vcpu_ioctl+0x1806/0x2100 [kvm]
>>>     kvm_vcpu_ioctl+0x663/0x8a0 [kvm]
>>>     __x64_sys_ioctl+0xb8/0xf0
>>>     do_syscall_64+0x56/0x80
>>>     entry_SYSCALL_64_after_hwframe+0x46/0xb0
>>>    RIP: 0033:0x7fade8b9dd6f
>>
>> Isn't this WARN_ON_ONCE() inherently racy, though? With your patch applied,
>> it can still be hit by juggling the APIC modes.
> 
> Doh, right, the logic is unfortunately cross-vCPU.  The sanity check could be
> conditioned on the APIC belonging to the running/loaded vCPU, but I'm leaning
> towards deleting it entirely.  Though it did detect the KVM_SET_LAPIC backdoor...

Yeah, let's drop it since we do have a test (in userspace).

Paolo