From patchwork Wed Nov 9 16:51:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "kirill.shutemov@linux.intel.com" X-Patchwork-Id: 13037761 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5355C433FE for ; Wed, 9 Nov 2022 16:52:30 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 683328E0005; Wed, 9 Nov 2022 11:52:21 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 369988E000A; Wed, 9 Nov 2022 11:52:21 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 07D978E0008; Wed, 9 Nov 2022 11:52:20 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id DDF9F8E0005 for ; Wed, 9 Nov 2022 11:52:20 -0500 (EST) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id F1E491606BF for ; Wed, 9 Nov 2022 16:52:19 +0000 (UTC) X-FDA: 80114496798.01.D54D805 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by imf10.hostedemail.com (Postfix) with ESMTP id 49549C0002 for ; Wed, 9 Nov 2022 16:52:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1668012739; x=1699548739; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=PRHpYCdvQPrEk4Dh8NC0NI3aanRW/V6efiDpPBADx4Y=; b=TygHs3kSZ2Sm/FQBkGTn8pSnkhgqhPSSedePkQYDPfPFIwNUTwkzvEUj cz3veemBdi6fyzn88HG7wV0DEcvcurTyE956E+fkJjNB2v1kbD9YMx9Gz lg0JuxdLRX2LJifQL3yVfblD2w1td54BOsK6wFidZnHMqufJr90f1da/z g+S+OeZGwk9D16w1D/fcO70JDCIv6i807GtqEnHEU5R1fMabEJLW30mQn wnYZAbaLFZLAPJAeSKvuaAzx7cym+apIzT+T64H6UlNS9oRkzU0c/7BOD UZJjWI9Y65Nt2NoU6aHOZz1/b4H2LHPHCflsnLwuh0fYCyxa9CN+mggmK A==; X-IronPort-AV: E=McAfee;i="6500,9779,10526"; a="311026962" X-IronPort-AV: E=Sophos;i="5.96,151,1665471600"; d="scan'208";a="311026962" Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Nov 2022 08:52:16 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10526"; a="587827259" X-IronPort-AV: E=Sophos;i="5.96,151,1665471600"; d="scan'208";a="587827259" Received: from dschramm-mobl.ger.corp.intel.com (HELO box.shutemov.name) ([10.251.219.85]) by orsmga003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Nov 2022 08:52:10 -0800 Received: by box.shutemov.name (Postfix, from userid 1000) id 93A4C109472; Wed, 9 Nov 2022 19:52:00 +0300 (+03) From: "Kirill A. Shutemov" To: Dave Hansen , Andy Lutomirski , Peter Zijlstra Cc: x86@kernel.org, Kostya Serebryany , Andrey Ryabinin , Andrey Konovalov , Alexander Potapenko , Taras Madan , Dmitry Vyukov , "H . J . Lu" , Andi Kleen , Rick Edgecombe , Bharata B Rao , Jacob Pan , Ashok Raj , linux-mm@kvack.org, linux-kernel@vger.kernel.org, "Kirill A. Shutemov" , Marc Zyngier Subject: [PATCHv12 06/16] KVM: Serialize tagged address check against tagging enabling Date: Wed, 9 Nov 2022 19:51:30 +0300 Message-Id: <20221109165140.9137-7-kirill.shutemov@linux.intel.com> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221109165140.9137-1-kirill.shutemov@linux.intel.com> References: <20221109165140.9137-1-kirill.shutemov@linux.intel.com> MIME-Version: 1.0 ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1668012739; a=rsa-sha256; cv=none; b=UOr5B1rf8rrMx9cc4XeLF/MoGoVHpH1VxuQcrKAMmO80wB4OnjGC7x0iqNBSeSUmOmwauG k+c8mmWs9BdphSTg7eKwzrXiPfRoTIg80YXRiGdoRFlVJ0GuW5iyKrBCu2ITFWwaGAZbju yWq+jtB3fURW5HDNHDUGAQq6DLFNMLI= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=TygHs3kS; spf=none (imf10.hostedemail.com: domain of kirill.shutemov@linux.intel.com has no SPF policy when checking 192.55.52.115) smtp.mailfrom=kirill.shutemov@linux.intel.com; dmarc=fail reason="No valid SPF" header.from=intel.com (policy=none) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1668012739; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ZsMnpelDH6S8NiPofehi/MISgeT2xNjyCketcrjkirg=; b=zRGoLPo4YtPESGBOUiXPZFOtSPuQJSq/ibDLExkSorl0C0+xykgw+y+4SI5PAfwrx5SS+9 y2KUMa2wmr/707YZPemFAqvGw4HPV/K2JNYiymJ8SWiz+TSJYnfOtRqUAGGQ58px4L2mmx PVDsN4EvtQ/tL3LW5q8XQx4s8IlSTKQ= Authentication-Results: imf10.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=TygHs3kS; spf=none (imf10.hostedemail.com: domain of kirill.shutemov@linux.intel.com has no SPF policy when checking 192.55.52.115) smtp.mailfrom=kirill.shutemov@linux.intel.com; dmarc=fail reason="No valid SPF" header.from=intel.com (policy=none) X-Rspamd-Server: rspam12 X-Rspam-User: X-Stat-Signature: wc4ca1jcmiethhgmg7yrt7bcwiw44xot X-Rspamd-Queue-Id: 49549C0002 X-HE-Tag: 1668012739-807166 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: KVM forbids usage of tagged userspace addresses for memslots. It is done by checking if the address stays the same after untagging. It is works fine for ARM TBI, but it the check gets racy for LAM. TBI enabling happens per-thread, so nobody can enable tagging for the thread while the memslot gets added. LAM gets enabled per-process. If it gets enabled after the untagged_addr() check, but before access_ok() check the kernel can wrongly allow tagged userspace_addr. Use mmap lock to protect against parallel LAM enabling. Signed-off-by: Kirill A. Shutemov Reported-by: Rick Edgecombe Cc: Marc Zyngier --- virt/kvm/kvm_main.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index d2139906ff91..8399aae16e83 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1943,12 +1943,22 @@ int __kvm_set_memory_region(struct kvm *kvm, return -EINVAL; if (mem->guest_phys_addr & (PAGE_SIZE - 1)) return -EINVAL; + + /* Serialize against tagging enabling */ + if (mmap_read_lock_killable(kvm->mm)) + return -EINTR; + /* We can read the guest memory with __xxx_user() later on. */ if ((mem->userspace_addr & (PAGE_SIZE - 1)) || (mem->userspace_addr != untagged_addr(kvm->mm, mem->userspace_addr)) || !access_ok((void __user *)(unsigned long)mem->userspace_addr, - mem->memory_size)) + mem->memory_size)) { + mmap_read_unlock(kvm->mm); return -EINVAL; + } + + mmap_read_unlock(kvm->mm); + if (as_id >= KVM_ADDRESS_SPACE_NUM || id >= KVM_MEM_SLOTS_NUM) return -EINVAL; if (mem->guest_phys_addr + mem->memory_size < mem->guest_phys_addr)