On Thu, 26 Oct 2017 15:45:46 +0200 Paolo Bonzini <[email protected]> wrote:
> On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. > > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. > > Cc: [email protected] > Cc: Kees Cook <[email protected]> > Cc: Christian Borntraeger <[email protected]> > Cc: Christoffer Dall <[email protected]> > Cc: Radim Krčmář <[email protected]> > Signed-off-by: Paolo Bonzini <[email protected]> > --- > virt/kvm/kvm_main.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 4d81f6ded88e..b4809ccfdfa1 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -4005,8 +4005,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, > unsigned vcpu_align, > /* A kmem cache lets us meet the alignment requirements of fx_save. */ > if (!vcpu_align) > vcpu_align = __alignof__(struct kvm_vcpu); > - kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, > - 0, NULL); > + kvm_vcpu_cache = > + kmem_cache_create_usercopy("kvm_vcpu", > + sizeof(struct kvm_vcpu), vcpu_align, > + 0, offsetof(struct kvm_vcpu, arch), > + sizeof_field(struct kvm_vcpu, arch), > + NULL); > if (!kvm_vcpu_cache) { > r = -ENOMEM; > goto out_free_3; Acked-by: Cornelia Huck <[email protected]>
