Messages in this thread | | | From | Marc Zyngier <> | Subject | Re: [PATCH 1/2] kvm: whitelist struct kvm_vcpu_arch | Date | Thu, 26 Oct 2017 15:34:38 +0100 |
| |
On Thu, Oct 26 2017 at 3:45:46 pm BST, Paolo Bonzini <pbonzini@redhat.com> wrote: > On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. > > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. > > Cc: kernel-hardening@lists.openwall.com > Cc: Kees Cook <keescook@chromium.org> > Cc: Christian Borntraeger <borntraeger@redhat.com> > Cc: Christoffer Dall <cdall@linaro.org> > Cc: Radim Krčmář <rkrcmar@redhat.com> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
M. -- Jazz is not dead. It just smells funny.
| |