linux-kernel - Re: [PATCH v9 3/6] KVM: arm64: Block cacheable PFNMAP mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aF6hamOI7YVDP1Cp@willie-the-truck>
Date: Fri, 27 Jun 2025 14:49:30 +0100
From: Will Deacon <will@...nel.org>
To: ankita@...dia.com
Cc: jgg@...dia.com, maz@...nel.org, oliver.upton@...ux.dev,
	joey.gouly@....com, suzuki.poulose@....com, yuzenghui@...wei.com,
	catalin.marinas@....com, ryan.roberts@....com, shahuang@...hat.com,
	lpieralisi@...nel.org, david@...hat.com, ddutile@...hat.com,
	seanjc@...gle.com, aniketa@...dia.com, cjia@...dia.com,
	kwankhede@...dia.com, kjaju@...dia.com, targupta@...dia.com,
	vsethi@...dia.com, acurrid@...dia.com, apopple@...dia.com,
	jhubbard@...dia.com, danw@...dia.com, zhiw@...dia.com,
	mochs@...dia.com, udhoke@...dia.com, dnigam@...dia.com,
	alex.williamson@...hat.com, sebastianene@...gle.com,
	coltonlewis@...gle.com, kevin.tian@...el.com, yi.l.liu@...el.com,
	ardb@...nel.org, akpm@...ux-foundation.org, gshan@...hat.com,
	linux-mm@...ck.org, tabba@...gle.com, qperret@...gle.com,
	kvmarm@...ts.linux.dev, linux-kernel@...r.kernel.org,
	linux-arm-kernel@...ts.infradead.org, maobibo@...ngson.cn,
	pbonzini@...hat.com
Subject: Re: [PATCH v9 3/6] KVM: arm64: Block cacheable PFNMAP mapping

On Sat, Jun 21, 2025 at 04:21:08AM +0000, ankita@...dia.com wrote:
> From: Ankit Agrawal <ankita@...dia.com>
> 
> Fixes a security bug due to mismatched attributes between S1 and
> S2 mapping.
> 
> Currently, it is possible for a region to be cacheable in the userspace
> VMA, but mapped non cached in S2. This creates a potential issue where
> the VMM may sanitize cacheable memory across VMs using cacheable stores,
> ensuring it is zeroed. However, if KVM subsequently assigns this memory
> to a VM as uncached, the VM could end up accessing stale, non-zeroed data
> from a previous VM, leading to unintended data exposure. This is a security
> risk.
> 
> Block such mismatch attributes case by returning EINVAL when userspace
> try to map PFNMAP cacheable. Only allow NORMAL_NC and DEVICE_*.
> 
> CC: Oliver Upton <oliver.upton@...ux.dev>
> CC: Catalin Marinas <catalin.marinas@....com>
> CC: Sean Christopherson <seanjc@...gle.com>
> Suggested-by: Jason Gunthorpe <jgg@...dia.com>
> Signed-off-by: Ankit Agrawal <ankita@...dia.com>
> ---
>  arch/arm64/kvm/mmu.c | 34 +++++++++++++++++++++++++++++++++-
>  1 file changed, 33 insertions(+), 1 deletion(-)

Sorry for the drive-by comment, but I was looking at this old series from
Paolo (look at the cover letter and patch 5):

https://lore.kernel.org/r/20250109133817.314401-1-pbonzini@redhat.com

in which he points out that the arm64 get_vma_page_shift() function
incorrectly assumes that a VM_PFNMAP VMA is physically contiguous, which
may not be the case if a driver calls remap_pfn_range() to mess around
with mappings within the VMA. I think that implies that the optimisation
in 2aa53d68cee6 ("KVM: arm64: Try stage2 block mapping for host device
MMIO") is unsound.

But it got me thinking -- given that remap_pfn_range() also takes a 'prot'
argument, how do we ensure that this is reflected in the guest? It feels
a bit dodgy to rely on drivers always passing 'vma->vm_page_prot'.

Will