From patchwork Sat Oct 21 18:45:45 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Christoffer Dall X-Patchwork-Id: 10021485 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C50BE60224 for ; Sat, 21 Oct 2017 18:46:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AAD37287B3 for ; Sat, 21 Oct 2017 18:46:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9F17D28A93; Sat, 21 Oct 2017 18:46:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 76BAE287B3 for ; Sat, 21 Oct 2017 18:46:01 +0000 (UTC) Received: (qmail 28454 invoked by uid 550); 21 Oct 2017 18:45:58 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 28436 invoked from network); 21 Oct 2017 18:45:57 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version:in-reply-to :references:content-transfer-encoding; bh=mhoWU+0bAJZPLVprE4FtQp0fckQ0yLKORmtYnhLTuy0=; b=Sn4OJ+j8LkDsK01OL3COQqxJokAy73KjT+3TFuFGcwS1a8skW5pEWiWwMOfAdS0HFQ 2u2y/xsVkVt9wOu4V75V909sJ+zrHXpTeGArU/qcTED9eXgfCqgB7VDvHPokYn0aZRkP wJzN+FnTOzm0bjec07FLEQUZlJNYccYOmB72k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :in-reply-to:references:content-transfer-encoding; bh=mhoWU+0bAJZPLVprE4FtQp0fckQ0yLKORmtYnhLTuy0=; b=tCPVMqXVtPnQiYM2Qf6oMeuxsR1HnSI7ESZHiWYcQXSUG/VgGUMNiqbc+4tHCfblGy JRY5DpivHz08UNOQvbERnpe7rOkl+PjKFRn3GSDgCAbLjm3GdIYDJSZtP8PJM2a8Shcs OOv0/oFgu5ziCfdcOfO2Ovk1jv7DxLwJdWfKFWLdpd+aIK1CM0CgyEclF6W3hVaCBvgX BqzLnRPzhn3GNBam6AbeQY+mlGXF7/NyA/yqtdEoi/zErS44O3XmxlMyuLm5Q8iAYYLw qe0/u+XJpFW4MAJ7bpvI+xzDK4Og83mSR+YcIPxeVDIh3ucSrh4KrT8aKyhA4RFmEw4X Ru4g== X-Gm-Message-State: AMCzsaXOIvrrYpNCPSIH/vcMmSPiWIVnVcYLdOLmiVI4oYIKPb3B+ySD 2Vi93WB/8XqXw4msry39gp9Y+A== X-Google-Smtp-Source: ABhQp+ST4kXzCehmdE5WaZe2Yo8bAd3QUFI4YVus9TH/NmeJd/26GBpssOWY0sihDHbg9VCQsvgR8A== X-Received: by 10.80.231.145 with SMTP id b17mr10828651edn.94.1508611546399; Sat, 21 Oct 2017 11:45:46 -0700 (PDT) From: Christoffer Dall To: kvmarm@lists.cs.columbia.edu Cc: linux-arm-kernel@lists.infradead.org, kvm@vger.kernel.org, Christoffer Dall , kernel-hardening@lists.openwall.com, Kees Cook , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Marc Zyngier Date: Sat, 21 Oct 2017 20:45:45 +0200 Message-Id: <20171021184545.2497-1-christoffer.dall@linaro.org> X-Mailer: git-send-email 2.14.2 MIME-Version: 1.0 In-Reply-To: <20171020232525.7387-1-pbonzini@redhat.com> References: <20171020232525.7387-1-pbonzini@redhat.com> Subject: [kernel-hardening] [PATCH] KVM: arm/arm64: Allow usercopy to vcpu->arch.ctxt and arm64 debug X-Virus-Scanned: ClamAV using ClamSMTP We do direct useraccess copying to the kvm_cpu_context structure embedded in the kvm_vcpu_arch structure, and to the vcpu debug register state. Everything else (timer, PMU, vgic) goes through a temporary indirection. Fixing all accesses to kvm_cpu_context is massively invasive, and we'd like to avoid that, so we tell kvm_init_usercopy to whitelist accesses to out context structure. The debug system register accesses on arm64 are modified to work through an indirection instead. Cc: kernel-hardening@lists.openwall.com Cc: Kees Cook Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Marc Zyngier Signed-off-by: Christoffer Dall --- This fixes KVM/ARM on today's linux next with CONFIG_HARDENED_USERCOPY. The patch is based on linux-next plus Paolo's x86 patch which introduces kvm_init_usercopy. Not sure how this needs to get merged, but it would potentially make sense for Paolo to put together a set of the patches needed for this. Thanks, -Christoffer arch/arm64/kvm/sys_regs.c | 36 ++++++++++++++++++++---------------- virt/kvm/arm/arm.c | 5 ++++- 2 files changed, 24 insertions(+), 17 deletions(-) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 2e070d3baf9f..cdf47a9108fe 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -293,19 +293,20 @@ static bool trap_bvr(struct kvm_vcpu *vcpu, static int set_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, const struct kvm_one_reg *reg, void __user *uaddr) { - __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg]; + __u64 r; - if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0) + if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0) return -EFAULT; + vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg] = r; return 0; } static int get_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, const struct kvm_one_reg *reg, void __user *uaddr) { - __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg]; + __u64 r = vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg]; - if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0) + if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0) return -EFAULT; return 0; } @@ -335,10 +336,11 @@ static bool trap_bcr(struct kvm_vcpu *vcpu, static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, const struct kvm_one_reg *reg, void __user *uaddr) { - __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg]; + __u64 r; - if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0) + if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0) return -EFAULT; + vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg] = r; return 0; } @@ -346,9 +348,9 @@ static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, static int get_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, const struct kvm_one_reg *reg, void __user *uaddr) { - __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg]; + __u64 r = vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg]; - if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0) + if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0) return -EFAULT; return 0; } @@ -379,19 +381,20 @@ static bool trap_wvr(struct kvm_vcpu *vcpu, static int set_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, const struct kvm_one_reg *reg, void __user *uaddr) { - __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg]; + __u64 r; - if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0) + if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0) return -EFAULT; + vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg] = r; return 0; } static int get_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, const struct kvm_one_reg *reg, void __user *uaddr) { - __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg]; + __u64 r = vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg]; - if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0) + if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0) return -EFAULT; return 0; } @@ -421,19 +424,20 @@ static bool trap_wcr(struct kvm_vcpu *vcpu, static int set_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, const struct kvm_one_reg *reg, void __user *uaddr) { - __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg]; + __u64 r; - if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0) + if (copy_from_user(&r, uaddr, KVM_REG_SIZE(reg->id)) != 0) return -EFAULT; + vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg] = r; return 0; } static int get_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd, const struct kvm_one_reg *reg, void __user *uaddr) { - __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg]; + __u64 r = vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg]; - if (copy_to_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0) + if (copy_to_user(uaddr, &r, KVM_REG_SIZE(reg->id)) != 0) return -EFAULT; return 0; } diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c index b9f68e4add71..639e388678ff 100644 --- a/virt/kvm/arm/arm.c +++ b/virt/kvm/arm/arm.c @@ -1502,7 +1502,10 @@ void kvm_arch_exit(void) static int arm_init(void) { - int rc = kvm_init(NULL, sizeof(struct kvm_vcpu), 0, THIS_MODULE); + int rc = kvm_init_usercopy(NULL, sizeof(struct kvm_vcpu), 0, + offsetof(struct kvm_vcpu_arch, ctxt), + sizeof_field(struct kvm_vcpu_arch, ctxt), + THIS_MODULE); return rc; }