From patchwork Wed May 8 22:28:06 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andre Przywara X-Patchwork-Id: 2541991 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from casper.infradead.org (casper.infradead.org [85.118.1.10]) by patchwork2.kernel.org (Postfix) with ESMTP id 585A3DF2E5 for ; Wed, 8 May 2013 22:29:29 +0000 (UTC) Received: from merlin.infradead.org ([2001:4978:20e::2]) by casper.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1UaCrX-00040x-K7; Wed, 08 May 2013 22:29:27 +0000 Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1UaCrU-0003UJ-Rw; Wed, 08 May 2013 22:29:24 +0000 Received: from mail-oa0-f48.google.com ([209.85.219.48]) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1UaCrR-0003Tk-Hj for linux-arm-kernel@lists.infradead.org; Wed, 08 May 2013 22:29:22 +0000 Received: by mail-oa0-f48.google.com with SMTP id i4so2690415oah.35 for ; Wed, 08 May 2013 15:28:59 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:from:to:cc:subject:date:message-id:x-mailer :x-gm-message-state; bh=GsGERPj4WltOF/9FcuI+OBvGbvr08h/3M+r8wOVV9vg=; b=Wb9sa5fCrv+A3d3SDJRH+b1FdkztTYMe5NoVO2tgJygVAcREAzrA95VRSbrvo5Qd5O qt8WO3RfU1z4YU+qJIw6KmTPAD+KQsBLc3OEBiGmt8J3lqfFgs9GnC22mGOgY+QzqDe0 jd0ExIs/I0uFRmct6+PFSE1Z4WB7mKCY0yborNye3qGRdA6EGfJwhb709/RsnL3zXLYS LGPA/YOYyW8lOjFyQ+VB+n4PPP6GJCe1mTjyUwgSdz/12uaipQr6M7MwFMNRAbrUV5X0 WPF+52lZeyyojzugb4/vQKJRZCsJcuDPisCqFqXczJQ232ZOaQJWkNATKbcyg08bFlt9 exOQ== X-Received: by 10.60.118.196 with SMTP id ko4mr2890076oeb.2.1368052138913; Wed, 08 May 2013 15:28:58 -0700 (PDT) Received: from localhost.localdomain (f048094010.adsl.alicedsl.de. [78.48.94.10]) by mx.google.com with ESMTPSA id c20sm427529oez.4.2013.05.08.15.28.56 for (version=TLSv1.2 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 08 May 2013 15:28:58 -0700 (PDT) From: Andre Przywara To: cdall@cs.columbia.edu, marc.zyngier@arm.com Subject: [PATCH v2] ARM: KVM: prevent NULL pointer dereferences with KVM VCPU ioctl Date: Thu, 9 May 2013 00:28:06 +0200 Message-Id: <1368052086-25059-1-git-send-email-andre.przywara@linaro.org> X-Mailer: git-send-email 1.7.12.1 X-Gm-Message-State: ALoCoQnnKLiA0DwZPxFAhlgBdS5t/p18fIy7egpX/UB4r3e+4Ky9jvkUhLm3J/1IVom4y9yLkbyq X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130508_182921_610552_497D32FB X-CRM114-Status: GOOD ( 13.65 ) X-Spam-Score: -2.6 (--) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-2.6 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [209.85.219.48 listed in list.dnswl.org] -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] Cc: Andre Przywara , kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, patches@linaro.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org Some ARM KVM VCPU ioctls require the vCPU to be properly initialized with the KVM_ARM_VCPU_INIT ioctl before being used with further requests. KVM_RUN checks whether this initialization has been done, but other ioctls do not. Namely KVM_GET_REG_LIST will dereference an array with index -1 without initialization and thus leads to a kernel oops. Fix this by adding checks before executing the ioctl handlers. Changes from v1: * moved check into a static function with a meaningful name Signed-off-by: Andre Przywara --- arch/arm/kvm/arm.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c index c1fe498..b73b587 100644 --- a/arch/arm/kvm/arm.c +++ b/arch/arm/kvm/arm.c @@ -676,6 +676,15 @@ static void vcpu_pause(struct kvm_vcpu *vcpu) wait_event_interruptible(*wq, !vcpu->arch.pause); } +/* + * Some ioctls require initialization by KVM_ARM_VCPU_INIT first, check + * this with this function + */ +static int kvm_vcpu_initialized(struct kvm_vcpu *vcpu) +{ + return vcpu->arch.target >= 0; +} + /** * kvm_arch_vcpu_ioctl_run - the main VCPU run function to execute guest code * @vcpu: The VCPU pointer @@ -692,8 +701,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run) int ret; sigset_t sigsaved; - /* Make sure they initialize the vcpu with KVM_ARM_VCPU_INIT */ - if (unlikely(vcpu->arch.target < 0)) + if (unlikely(!kvm_vcpu_initialized(vcpu))) return -ENOEXEC; ret = kvm_vcpu_first_run_init(vcpu); @@ -893,6 +901,10 @@ long kvm_arch_vcpu_ioctl(struct file *filp, case KVM_SET_ONE_REG: case KVM_GET_ONE_REG: { struct kvm_one_reg reg; + + if (unlikely(!kvm_vcpu_initialized(vcpu))) + return -ENOEXEC; + if (copy_from_user(®, argp, sizeof(reg))) return -EFAULT; if (ioctl == KVM_SET_ONE_REG) @@ -905,6 +917,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, struct kvm_reg_list reg_list; unsigned n; + if (unlikely(!kvm_vcpu_initialized(vcpu))) + return -ENOEXEC; + if (copy_from_user(®_list, user_list, sizeof(reg_list))) return -EFAULT; n = reg_list.n;