lkml.org 
[lkml]   [2017]   [Dec]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH RESEND] KVM: X86: Fix stack-out-of-bounds read in write_mmio
2017-12-13 0:07 GMT+08:00 Paolo Bonzini <pbonzini@redhat.com>:
> On 12/12/2017 09:57, Wanpeng Li wrote:
>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index bc5d853..51e7932 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -4690,7 +4690,10 @@ static int write_emulate(struct kvm_vcpu *vcpu, gpa_t gpa,
>>
>> static int write_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes, void *val)
>> {
>> - trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, *(u64 *)val);
>> + u64 data = 0;
>> +
>> + memcpy(&data, val, min(8, bytes));
>> + trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, data);
>> return vcpu_mmio_write(vcpu, gpa, bytes, val);
>> }
>>
>>
>
> Please do the memcpy in TRACE_EVENT(kvm_mmio)'s TP_fast_assign block.
> That is done only when the trace event is active.

I still can observe the stack out-of-bounds read warning if keep *(u64
*)val as the parameter since it has already been dereferenced. So
maybe we should change the parameter of trace_kvm_mmio() to void *val,
however, I'm not sure whether it will break the tracepoint ABI which
this article https://lwn.net/Articles/734039/ "Workload analysis with
tracing" section pointed out.

Regards,
Wanpeng Li

\
 
 \ /
  Last update: 2017-12-13 04:05    [W:0.042 / U:1.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site