lkml.org 
[lkml]   [2010]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[149/289] KVM: x86: fix information leak to userland
    2.6.36-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Vasiliy Kulikov <segooon@gmail.com>

    commit 97e69aa62f8b5d338d6cff49be09e37cc1262838 upstream.

    Structures kvm_vcpu_events, kvm_debugregs, kvm_pit_state2 and
    kvm_clock_data are copied to userland with some padding and reserved
    fields unitialized. It leads to leaking of contents of kernel stack
    memory. We have to initialize them to zero.

    In patch v1 Jan Kiszka suggested to fill reserved fields with zeros
    instead of memset'ting the whole struct. It makes sense as these
    fields are explicitly marked as padding. No more fields need zeroing.

    Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    arch/x86/kvm/x86.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -2305,6 +2305,7 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_
    !kvm_exception_is_soft(vcpu->arch.exception.nr);
    events->exception.nr = vcpu->arch.exception.nr;
    events->exception.has_error_code = vcpu->arch.exception.has_error_code;
    + events->exception.pad = 0;
    events->exception.error_code = vcpu->arch.exception.error_code;

    events->interrupt.injected =
    @@ -2318,12 +2319,14 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_
    events->nmi.injected = vcpu->arch.nmi_injected;
    events->nmi.pending = vcpu->arch.nmi_pending;
    events->nmi.masked = kvm_x86_ops->get_nmi_mask(vcpu);
    + events->nmi.pad = 0;

    events->sipi_vector = vcpu->arch.sipi_vector;

    events->flags = (KVM_VCPUEVENT_VALID_NMI_PENDING
    | KVM_VCPUEVENT_VALID_SIPI_VECTOR
    | KVM_VCPUEVENT_VALID_SHADOW);
    + memset(&events->reserved, 0, sizeof(events->reserved));
    }

    static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
    @@ -2366,6 +2369,7 @@ static void kvm_vcpu_ioctl_x86_get_debug
    dbgregs->dr6 = vcpu->arch.dr6;
    dbgregs->dr7 = vcpu->arch.dr7;
    dbgregs->flags = 0;
    + memset(&dbgregs->reserved, 0, sizeof(dbgregs->reserved));
    }

    static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
    @@ -2849,6 +2853,7 @@ static int kvm_vm_ioctl_get_pit2(struct
    sizeof(ps->channels));
    ps->flags = kvm->arch.vpit->pit_state.flags;
    mutex_unlock(&kvm->arch.vpit->pit_state.lock);
    + memset(&ps->reserved, 0, sizeof(ps->reserved));
    return r;
    }

    @@ -3229,6 +3234,7 @@ long kvm_arch_vm_ioctl(struct file *filp
    now_ns = timespec_to_ns(&now);
    user_ns.clock = kvm->arch.kvmclock_offset + now_ns;
    user_ns.flags = 0;
    + memset(&user_ns.pad, 0, sizeof(user_ns.pad));

    r = -EFAULT;
    if (copy_to_user(argp, &user_ns, sizeof(user_ns)))



    \
     
     \ /
      Last update: 2010-12-08 02:35    [W:0.028 / U:0.220 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site