linux-kernel - [PATCH v3 0/6] KVM: Dirty ring fixes and cleanups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250516213540.2546077-1-seanjc@google.com>
Date: Fri, 16 May 2025 14:35:34 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Peter Xu <peterx@...hat.com>, Yan Zhao <yan.y.zhao@...el.com>, 
	Maxim Levitsky <mlevitsk@...hat.com>, Binbin Wu <binbin.wu@...ux.intel.com>, 
	James Houghton <jthoughton@...gle.com>, Sean Christopherson <seanjc@...gle.com>, 
	Pankaj Gupta <pankaj.gupta@....com>
Subject: [PATCH v3 0/6]  KVM: Dirty ring fixes and cleanups

Fix issues with dirty ring harvesting where KVM doesn't bound the processing
of entries in any way, which allows userspace to keep KVM in a tight loop
indefinitely.

E.g.

        struct kvm_dirty_gfn *dirty_gfns = vcpu_map_dirty_ring(vcpu);

        if (fork()) {
                int r;

                for (;;) {
                        r = kvm_vm_reset_dirty_ring(vcpu->vm);
                        if (r)
                                printf("RESET %d dirty ring entries\n", r);
                }
        } else {
                int i;

                for (i = 0; i < test_dirty_ring_count; i++) {
                        dirty_gfns[i].slot = TEST_MEM_SLOT_INDEX;
                        dirty_gfns[i].offset = (i * 64) % host_num_pages;
                }

                for (;;) {
                        for (i = 0; i < test_dirty_ring_count; i++)
                                WRITE_ONCE(dirty_gfns[i].flags, KVM_DIRTY_GFN_F_RESET);
                }
        }

Patches 1-3 address that class of bugs.  Patches 4-6 are cleanups.

v3:
 - Fix typos (I apparently can't spell opportunistically to save my life).
   [Binbin, James]
 - Clean up stale comments. [Binbin]
 - Collect reviews. [James, Pankaj]
 - Add a lockdep assertion on slots_lock, along with a comment. [James]

v2:
 - https://lore.kernel.org/all/20250508141012.1411952-1-seanjc@google.com
 - Expand on comments in dirty ring harvesting code. [Yan]

v1: https://lore.kernel.org/all/20250111010409.1252942-1-seanjc@google.com

Sean Christopherson (6):
  KVM: Bound the number of dirty ring entries in a single reset at
    INT_MAX
  KVM: Bail from the dirty ring reset flow if a signal is pending
  KVM: Conditionally reschedule when resetting the dirty ring
  KVM: Check for empty mask of harvested dirty ring entries in caller
  KVM: Use mask of harvested dirty ring entries to coalesce dirty ring
    resets
  KVM: Assert that slots_lock is held when resetting per-vCPU dirty
    rings

 include/linux/kvm_dirty_ring.h |  18 ++----
 virt/kvm/dirty_ring.c          | 111 +++++++++++++++++++++++----------
 virt/kvm/kvm_main.c            |   9 ++-
 3 files changed, 89 insertions(+), 49 deletions(-)


base-commit: 7ef51a41466bc846ad794d505e2e34ff97157f7f
-- 
2.49.0.1112.g889b7c5bd8-goog