2016-07-11 18:14+0800, Yang Zhang: > On 2016/7/11 15:43, Paolo Bonzini wrote: >> On 11/07/2016 08:07, Yang Zhang wrote: >> > > >> > > mutex_lock(&kvm->arch.apic_map_lock); >> > > >> > > + kvm_for_each_vcpu(i, vcpu, kvm) >> > > + if (kvm_apic_present(vcpu)) >> > > + max_id = max(max_id, kvm_apic_id(vcpu->arch.apic)); >> > > + >> > > + new = kzalloc(sizeof(struct kvm_apic_map) + >> > > + sizeof(struct kvm_lapic *) * (max_id + 1), >> > > GFP_KERNEL); >> > > + >> > >> > I think this may cause the host runs out of memory if a malicious guest >> > did follow thing: >> > 1. vcpu a is doing apic map recalculation. >> > 2. vcpu b write the apic id with 0xff >> > 3. then vcpu b enable the x2apic: in kvm_lapic_set_base(), we will set >> > apic_base to new value before reset the apic id. >> > 4. vcpu a may see the x2apic enabled in vcpu b plus an old apic >> > id(0xff), and max_id will become (0xff >> 24). Indeed, thanks. The guest doesn't even have to be malicious ... >> The bug is not really here but in patch 6---but you're right nevertheless! Yes. >> I guess the easiest solution is to replace kvm_apic_id with a field in >> struct kvm_lapic, which is already shifted right by 24 in xAPIC mode. (I guess the fewest LOC is to look at vcpu->vcpu_id, which is equal to x2apic id. xapic id cannot be greater than 255 and all of those are covered by the initial value of max_id.) > Or we can just simply put the assignment of apic_base to the end. Yes, this would work, I'd also remove recalculates from kvm_apic_set_*apic_id() and add a compiler barrier with comment for good measure, even though set_virtual_x2apic_mode() serves as one. (What makes a bit wary is that it doesn't avoid the same problem if we changed KVM to reset apic id to xapic id first when disabling apic.) Races in recalculation and APIC ID changes also lead to invalid physical maps, which haven't been taken care of properly ... Having apic id stored in big endian, or "0-7,8-31" format, would be safest. I wanted to change the apic map to do incremental updates with with respect to the APIC that has changed, instead of being completely recomputed, so maybe the time is now. :) -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
