From patchwork Mon Feb 4 20:18:51 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nitesh Narayan Lal X-Patchwork-Id: 10796531 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1238414E1 for ; Mon, 4 Feb 2019 20:19:51 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 02A0B2C0FC for ; Mon, 4 Feb 2019 20:19:51 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 009D52C1A5; Mon, 4 Feb 2019 20:19:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 969872C0FC for ; Mon, 4 Feb 2019 20:19:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728158AbfBDUTt (ORCPT ); Mon, 4 Feb 2019 15:19:49 -0500 Received: from mx1.redhat.com ([209.132.183.28]:26758 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728042AbfBDUTs (ORCPT ); Mon, 4 Feb 2019 15:19:48 -0500 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0D213A0361; Mon, 4 Feb 2019 20:19:48 +0000 (UTC) Received: from virtlab420.virt.lab.eng.bos.redhat.com (virtlab420.virt.lab.eng.bos.redhat.com [10.19.152.148]) by smtp.corp.redhat.com (Postfix) with ESMTP id B14C68AD92; Mon, 4 Feb 2019 20:19:41 +0000 (UTC) From: Nitesh Narayan Lal To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, pbonzini@redhat.com, lcapitulino@redhat.com, pagupta@redhat.com, wei.w.wang@intel.com, yang.zhang.wz@gmail.com, riel@surriel.com, david@redhat.com, mst@redhat.com, dodgen@google.com, konrad.wilk@oracle.com, dhildenb@redhat.com, aarcange@redhat.com Subject: [RFC][Patch v8 4/7] KVM: Disabling page poisoning to prevent corruption Date: Mon, 4 Feb 2019 15:18:51 -0500 Message-Id: <20190204201854.2328-5-nitesh@redhat.com> In-Reply-To: <20190204201854.2328-1-nitesh@redhat.com> References: <20190204201854.2328-1-nitesh@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Mon, 04 Feb 2019 20:19:48 +0000 (UTC) Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch disables page poisoning if guest page hinting is enabled. It is required to avoid possible guest memory corruption errors. Page Poisoning is a feature in which the page is filled with a specific pattern of (0x00 or 0xaa) after arch_free_page and the same is verified before arch_alloc_page to prevent following issues: *information leak from the freed data *use after free bugs *memory corruption Selection of the pattern depends on the CONFIG_PAGE_POISONING_ZERO Once the guest pages which are supposed to be freed are sent to the hypervisor it frees them. After freeing the pages in the global list following things may happen: *Hypervisor reallocates the freed memory back to the guest *Hypervisor frees the memory and maps a different physical memory In order to prevent any information leak hypervisor before allocating memory to the guest fills it with zeroes. The issue arises when the pattern used for Page Poisoning is 0xaa while the newly allocated page received from the hypervisor by the guest is filled with the pattern 0x00. This will result in memory corruption errors. Signed-off-by: Nitesh Narayan Lal --- include/linux/page_hinting.h | 8 ++++++++ mm/page_poison.c | 2 +- virt/kvm/page_hinting.c | 1 + 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/include/linux/page_hinting.h b/include/linux/page_hinting.h index 2d7ff59f3f6a..e800c6b07561 100644 --- a/include/linux/page_hinting.h +++ b/include/linux/page_hinting.h @@ -19,7 +19,15 @@ struct hypervisor_pages { extern int guest_page_hinting_flag; extern struct static_key_false guest_page_hinting_key; extern struct smp_hotplug_thread hinting_threads; +extern bool want_page_poisoning; int guest_page_hinting_sysctl(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos); void guest_free_page(struct page *page, int order); + +static inline void disable_page_poisoning(void) +{ +#ifdef CONFIG_PAGE_POISONING + want_page_poisoning = 0; +#endif +} diff --git a/mm/page_poison.c b/mm/page_poison.c index f0c15e9017c0..9af96021133b 100644 --- a/mm/page_poison.c +++ b/mm/page_poison.c @@ -7,7 +7,7 @@ #include #include -static bool want_page_poisoning __read_mostly; +bool want_page_poisoning __read_mostly; static int __init early_page_poison_param(char *buf) { diff --git a/virt/kvm/page_hinting.c b/virt/kvm/page_hinting.c index 636990e7fbb3..be529f6f2bc0 100644 --- a/virt/kvm/page_hinting.c +++ b/virt/kvm/page_hinting.c @@ -103,6 +103,7 @@ void guest_free_page(struct page *page, int order) local_irq_save(flags); if (page_hinting_obj->kvm_pt_idx != MAX_FGPT_ENTRIES) { + disable_page_poisoning(); page_hinting_obj->kvm_pt[page_hinting_obj->kvm_pt_idx].pfn = page_to_pfn(page); page_hinting_obj->kvm_pt[page_hinting_obj->kvm_pt_idx].zonenum =