lkml.org 
[lkml]   [2020]   [Mar]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 0/7] KVM: Fix memslot use-after-free bug
    From
    Date
    On 20/03/20 21:55, Sean Christopherson wrote:
    > Fix a bug introduced by dynamic memslot allocation where the LRU slot can
    > become invalid and lead to a out-of-bounds/use-after-free scenario.
    >
    > The patch is different that what Qian has already tested, but I was able
    > to reproduce the bad behavior by enhancing the set memory region selftest,
    > i.e. I'm relatively confident the bug is fixed.
    >
    > Patches 2-6 are a variety of selftest cleanup, with the aforementioned
    > set memory region enhancement coming in patch 7.
    >
    > Note, I couldn't get the selftest to fail outright or with KASAN, but was
    > able to hit a WARN_ON an invalid slot 100% of the time (without the fix,
    > obviously).
    >
    > Regarding s390, I played around a bit with merging gfn_to_memslot_approx()
    > into search_memslots(). Code wise it's trivial since they're basically
    > identical, but doing so increases the code footprint of search_memslots()
    > on x86 by 30 bytes, so I ended up abandoning the effort.
    >
    > Sean Christopherson (7):
    > KVM: Fix out of range accesses to memslots
    > KVM: selftests: Fix cosmetic copy-paste error in vm_mem_region_move()
    > KVM: selftests: Take vcpu pointer instead of id in vm_vcpu_rm()
    > KVM: selftests: Add helpers to consolidate open coded list operations
    > KVM: selftests: Add util to delete memory region
    > KVM: selftests: Expose the primary memslot number to tests
    > KVM: selftests: Add "delete" testcase to set_memory_region_test
    >
    > arch/s390/kvm/kvm-s390.c | 3 +
    > include/linux/kvm_host.h | 3 +
    > .../testing/selftests/kvm/include/kvm_util.h | 3 +
    > tools/testing/selftests/kvm/lib/kvm_util.c | 139 ++++++++++--------
    > .../kvm/x86_64/set_memory_region_test.c | 122 +++++++++++++--
    > virt/kvm/kvm_main.c | 3 +
    > 6 files changed, 201 insertions(+), 72 deletions(-)
    >

    Queued patches 1-3, thanks.

    Paolo

    \
     
     \ /
      Last update: 2020-03-24 12:32    [W:3.632 / U:0.632 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site