Message ID | 20190815172237.10464-1-sean.j.christopherson@intel.com |
---|---|
State | Accepted |
Headers | show |
Series | KVM: Assert that struct kvm_vcpu is always as offset zero | expand |
On Thu, Aug 15, 2019 at 10:23 AM Sean Christopherson <sean.j.christopherson@intel.com> wrote: > > KVM implementations that wrap struct kvm_vcpu with a vendor specific > struct, e.g. struct vcpu_vmx, must place the vcpu member at offset 0, > otherwise the usercopy region intended to encompass struct kvm_vcpu_arch > will instead overlap random chunks of the vendor specific struct. > E.g. padding a large number of bytes before struct kvm_vcpu triggers > a usercopy warn when running with CONFIG_HARDENED_USERCOPY=y. > > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> X86 parts: Reviewed-by: Jim Mattson <jmattson@google.com>
On 15/08/19 19:22, Sean Christopherson wrote: > KVM implementations that wrap struct kvm_vcpu with a vendor specific > struct, e.g. struct vcpu_vmx, must place the vcpu member at offset 0, > otherwise the usercopy region intended to encompass struct kvm_vcpu_arch > will instead overlap random chunks of the vendor specific struct. > E.g. padding a large number of bytes before struct kvm_vcpu triggers > a usercopy warn when running with CONFIG_HARDENED_USERCOPY=y. > > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> > --- > > Note, the PowerPC change is completely untested. > > arch/powerpc/kvm/e500.c | 3 +++ > arch/x86/kvm/svm.c | 3 +++ > arch/x86/kvm/vmx/vmx.c | 3 +++ > 3 files changed, 9 insertions(+) > > diff --git a/arch/powerpc/kvm/e500.c b/arch/powerpc/kvm/e500.c > index b5a848a55504..00649ca5fa9a 100644 > --- a/arch/powerpc/kvm/e500.c > +++ b/arch/powerpc/kvm/e500.c > @@ -440,6 +440,9 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_e500(struct kvm *kvm, > struct kvm_vcpu *vcpu; > int err; > > + BUILD_BUG_ON_MSG(offsetof(struct kvmppc_vcpu_e500, vcpu) != 0, > + "struct kvm_vcpu must be at offset 0 for arch usercopy region"); > + > vcpu_e500 = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL); > if (!vcpu_e500) { > err = -ENOMEM; > diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c > index d685491fce4d..70015ae5fc19 100644 > --- a/arch/x86/kvm/svm.c > +++ b/arch/x86/kvm/svm.c > @@ -2137,6 +2137,9 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id) > struct page *nested_msrpm_pages; > int err; > > + BUILD_BUG_ON_MSG(offsetof(struct vcpu_svm, vcpu) != 0, > + "struct kvm_vcpu must be at offset 0 for arch usercopy region"); > + > svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL_ACCOUNT); > if (!svm) { > err = -ENOMEM; > diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c > index 42ed3faa6af8..402cf2fe5cdd 100644 > --- a/arch/x86/kvm/vmx/vmx.c > +++ b/arch/x86/kvm/vmx/vmx.c > @@ -6615,6 +6615,9 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) > unsigned long *msr_bitmap; > int cpu; > > + BUILD_BUG_ON_MSG(offsetof(struct vcpu_vmx, vcpu) != 0, > + "struct kvm_vcpu must be at offset 0 for arch usercopy region"); > + > vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL_ACCOUNT); > if (!vmx) > return ERR_PTR(-ENOMEM); > Queued, thanks. Paolo
diff --git a/arch/powerpc/kvm/e500.c b/arch/powerpc/kvm/e500.c index b5a848a55504..00649ca5fa9a 100644 --- a/arch/powerpc/kvm/e500.c +++ b/arch/powerpc/kvm/e500.c @@ -440,6 +440,9 @@ static struct kvm_vcpu *kvmppc_core_vcpu_create_e500(struct kvm *kvm, struct kvm_vcpu *vcpu; int err; + BUILD_BUG_ON_MSG(offsetof(struct kvmppc_vcpu_e500, vcpu) != 0, + "struct kvm_vcpu must be at offset 0 for arch usercopy region"); + vcpu_e500 = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL); if (!vcpu_e500) { err = -ENOMEM; diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index d685491fce4d..70015ae5fc19 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -2137,6 +2137,9 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id) struct page *nested_msrpm_pages; int err; + BUILD_BUG_ON_MSG(offsetof(struct vcpu_svm, vcpu) != 0, + "struct kvm_vcpu must be at offset 0 for arch usercopy region"); + svm = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL_ACCOUNT); if (!svm) { err = -ENOMEM; diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 42ed3faa6af8..402cf2fe5cdd 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -6615,6 +6615,9 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) unsigned long *msr_bitmap; int cpu; + BUILD_BUG_ON_MSG(offsetof(struct vcpu_vmx, vcpu) != 0, + "struct kvm_vcpu must be at offset 0 for arch usercopy region"); + vmx = kmem_cache_zalloc(kvm_vcpu_cache, GFP_KERNEL_ACCOUNT); if (!vmx) return ERR_PTR(-ENOMEM);
KVM implementations that wrap struct kvm_vcpu with a vendor specific struct, e.g. struct vcpu_vmx, must place the vcpu member at offset 0, otherwise the usercopy region intended to encompass struct kvm_vcpu_arch will instead overlap random chunks of the vendor specific struct. E.g. padding a large number of bytes before struct kvm_vcpu triggers a usercopy warn when running with CONFIG_HARDENED_USERCOPY=y. Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com> --- Note, the PowerPC change is completely untested. arch/powerpc/kvm/e500.c | 3 +++ arch/x86/kvm/svm.c | 3 +++ arch/x86/kvm/vmx/vmx.c | 3 +++ 3 files changed, 9 insertions(+)