linux-kernel - Re: [PATCH 0/6] KVM: Fix bugs in vCPUs xarray usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CABgObfad2=y7RckXsQY6TVQF21qVgk0gJ-M-nUz+eQiPCN_Kiw@mail.gmail.com>
Date: Thu, 19 Dec 2024 15:18:10 +0100
From: Paolo Bonzini <pbonzini@...hat.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Will Deacon <will@...nel.org>, Michal Luczaj <mhal@...x.co>, Alexander Potapenko <glider@...gle.com>, 
	Marc Zyngier <maz@...nel.org>, Oliver Upton <oliver.upton@...ux.dev>
Subject: Re: [PATCH 0/6] KVM: Fix bugs in vCPUs xarray usage

On Thu, Dec 19, 2024 at 3:44 AM Sean Christopherson <seanjc@...gle.com> wrote:
>
> On Wed, 09 Oct 2024 08:04:49 -0700, Sean Christopherson wrote:
> > This series stems from Will's observation[*] that kvm_vm_ioctl_create_vcpu()'s
> > handling of xa_store() failure when inserting into vcpu_array is technically
> > broken, although in practice it's impossible for xa_store() to fail.
> >
> > After much back and forth and staring, I realized that commit afb2acb2e3a3
> > ("KVM: Fix vcpu_array[0] races") papered over underlying bugs in
> > kvm_get_vcpu() and kvm_for_each_vcpu().  The core problem is that KVM
> > allowed other tasks to see vCPU0 while online_vcpus==0, and thus trying
> > to gracefully error out of vCPU creation led to use-after-free failures.
> >
> > [...]
>
> Applied to kvm-x86 vcpu_array to get coverage in -next, and to force Paolo's
> hand :-).
>
> Paolo, I put this in a dedicated branch so that it's easy to toss if you want to
> go a different direction for the xarray insertion mess.

Go ahead; we already do more or less the same in
kvm_vm_set_mem_attributes(), so I guess that's just an unavoidable
weirdness of xa_reserve().

Paolo

>
> [1/6] KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
>       https://github.com/kvm-x86/linux/commit/1e7381f3617d
> [2/6] KVM: Verify there's at least one online vCPU when iterating over all vCPUs
>       https://github.com/kvm-x86/linux/commit/0664dc74e9d0
> [3/6] KVM: Grab vcpu->mutex across installing the vCPU's fd and bumping online_vcpus
>       https://github.com/kvm-x86/linux/commit/6e2b2358b3ef
> [4/6] Revert "KVM: Fix vcpu_array[0] races"
>       https://github.com/kvm-x86/linux/commit/d0831edcd87e
> [5/6] KVM: Don't BUG() the kernel if xa_insert() fails with -EBUSY
>       https://github.com/kvm-x86/linux/commit/e53dc37f5a06
> [6/6] KVM: Drop hack that "manually" informs lockdep of kvm->lock vs. vcpu->mutex
>       https://github.com/kvm-x86/linux/commit/01528db67f28
>
> --
> https://github.com/kvm-x86/linux/tree/next
>