| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <aYuC87rMLlBYIZRc@google.com>
Date: Tue, 10 Feb 2026 11:11:47 -0800
From: Sean Christopherson <seanjc@...gle.com>
To: Zhangjiaji <zhangjiaji1@...wei.com>
Cc: Paolo Bonzini <pbonzini@...hat.com>, "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Wangqinxiao (Tom)" <wangqinxiao@...wei.com>,
zhangyashu <zhangyashu2@...artners.com>, "wangyanan (Y)" <wangyanan55@...wei.com>
Subject: Re: Re: [BUG REPORT] USE_AFTER_FREE in complete_emulated_mmio found
by KASAN/Syzkaller fuzz test (v5.10.0)
On Tue, Feb 10, 2026, Zhangjiaji wrote:
> > I think there's a not-completely-awful solution buried in this gigantic cesspool.
> > The only time KVM uses on-stack variables is for qword or smaller accesses, i.e.
> > 8 bytes in size or less. For larger fragments, e.g. AVX to/from MMIO, the target
> > value will always be an operand in the emulator context. And so rather than
> > disallow stack variables, for "small" fragments, we can rework the handling to
> > copy the value to/from each fragment on-demand instead of stashing a pointer to
> > the value.
>
> Since we can store the frag->val in struct kvm_mmio_fragment,
> why not just point frag->data to it? This Way we can save a lot code about
> (frag->data == NULL).
It's not quite that simple, because we need to handle reads as well.
> Though this patch will block any read-into-stack calls, we can add a special path
> in function emulator_read_write handling feasible read-into-stack calls -- the
> target is released just after emulator_read_write returns.
>
> ---
> arch/x86/kvm/x86.c | 9 ++++++++-
> include/linux/kvm_host.h | 3 ++-
> 2 files changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 72d37c8930ad..12d53d441a39 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -8197,7 +8197,14 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
> WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
> frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
> frag->gpa = gpa;
> - frag->data = val;
> + if (bytes > 8u || ! write) {
> + if (WARN_ON_ONCE(object_is_on_stack(val)))
This is user-triggerable, e.g. em_popa(), em_pop_sreg(), emulate_iret_real(),
em_ret_near_imm(), em_ret_far(), and em_ret().
That said, I do like redirecting frag->data to &frag->val instead of nullifying
the pointer. If the change to tracking head+tail is isolated as a prep commit,
the diff isn't actually that scary (see below). Combined with a reworked loop
for read_mmio_fragment() to make it easier to follow (still need to add comments),
fixing this isn't as insane as I originally worried.
static int read_mmio_fragment(struct kvm_vcpu *vcpu, void *val, int bytes)
{
int *head = &vcpu->mmio_head_fragment;
int tail = vcpu->mmio_tail_fragment;
struct kvm_mmio_fragment *frag;
if (vcpu->mmio_head_fragment >= vcpu->mmio_tail_fragment)
return 0;
if (WARN_ON_ONCE(tail > vcpu->mmio_nr_fragments ||
tail > ARRAY_SIZE(vcpu->mmio_fragments)))
return 0;
for ( ; *head < tail; ++(*head)) {
frag = &vcpu->mmio_fragments[*head];
if (WARN_ON_ONCE(bytes < frag->len))
break;
if (frag->data == &frag->val)
memcpy(val, frag->data, frag->len);
val += frag->len;
bytes -= frag->len;
}
trace_kvm_mmio(KVM_TRACE_MMIO_READ, bytes, frag->gpa, val);
return 1;
}
I'll put together a series, there are a pile of cleanups that can be done, and
I want to comment the snot out of all of this because every time I end up in this
code I have to re-learn the subtleties.
---
arch/x86/kvm/x86.c | 28 +++++++++++++++++++++++-----
include/linux/kvm_host.h | 3 ++-
2 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 8f698d68d85e..5886f082b5d6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8138,6 +8138,9 @@ static int read_mmio_fragment(struct kvm_vcpu *vcpu, void *val, int bytes)
if (WARN_ON_ONCE(bytes < frag->len))
break;
+ if (frag->data == &frag->val)
+ memcpy(val, frag->data, frag->len);
+
val += frag->len;
bytes -= frag->len;
}
@@ -8240,7 +8243,14 @@ static int emulator_read_write_onepage(unsigned long addr, void *val,
WARN_ON(vcpu->mmio_nr_fragments >= KVM_MAX_MMIO_FRAGMENTS);
frag = &vcpu->mmio_fragments[vcpu->mmio_nr_fragments++];
frag->gpa = gpa;
- frag->data = val;
+ if (bytes > 8u) {
+ frag->data = val;
+ } else {
+ frag->val = 0;
+ frag->data = &frag->val;
+ if (write)
+ memcpy(&frag->val, val, bytes);
+ }
frag->len = bytes;
return X86EMUL_CONTINUE;
}
@@ -8255,6 +8265,9 @@ static int emulator_read_write(struct x86_emulate_ctxt *ctxt,
gpa_t gpa;
int rc;
+ if (WARN_ON_ONCE(bytes > 8u && object_is_on_stack(val)))
+ return X86EMUL_UNHANDLEABLE;
+
if (ops->read_mmio_fragment &&
ops->read_mmio_fragment(vcpu, val, bytes))
return X86EMUL_CONTINUE;
@@ -11863,6 +11876,9 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
frag++;
vcpu->mmio_tail_fragment++;
} else {
+ if (WARN_ON_ONCE(frag->data == &frag->val))
+ return -EIO;
+
/* Go forward to the next mmio piece. */
frag->data += len;
frag->gpa += len;
@@ -14291,8 +14307,10 @@ static int complete_sev_es_emulated_mmio(struct kvm_vcpu *vcpu)
vcpu->mmio_needed = 0;
vcpu->mmio_tail_fragment = 0;
- // VMG change, at this point, we're always done
- // RIP has already been advanced
+ /*
+ * All done, as frag->data always points at the GHCB scratch
+ * area and VMGEXIT is trap-like (RIP is advanced by hardware).
+ */
return 1;
}
@@ -14315,7 +14333,7 @@ int kvm_sev_es_mmio_write(struct kvm_vcpu *vcpu, gpa_t gpa, unsigned int bytes,
int handled;
struct kvm_mmio_fragment *frag;
- if (!data)
+ if (!data || WARN_ON_ONCE(object_is_on_stack(data)))
return -EINVAL;
handled = write_emultor.read_write_mmio(vcpu, gpa, bytes, data);
@@ -14355,7 +14373,7 @@ int kvm_sev_es_mmio_read(struct kvm_vcpu *vcpu, gpa_t gpa, unsigned int bytes,
int handled;
struct kvm_mmio_fragment *frag;
- if (!data)
+ if (!data || WARN_ON_ONCE(object_is_on_stack(data)))
return -EINVAL;
handled = read_emultor.read_write_mmio(vcpu, gpa, bytes, data);
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 919682c6faeb..be4b9de5b8c9 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -320,7 +320,8 @@ static inline bool kvm_vcpu_can_poll(ktime_t cur, ktime_t stop)
struct kvm_mmio_fragment {
gpa_t gpa;
void *data;
- unsigned len;
+ u64 val;
+ unsigned int len;
};
struct kvm_vcpu {
--
Powered by blists - more mailing lists