On 10/23/2017 11:52 AM, David Hildenbrand wrote: > On 21.10.2017 01:25, Paolo Bonzini wrote: >> Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries >> field of struct kvm_vcpu_arch. Therefore, the new usercopy hardening >> work in linux-next, which forbids copies from and to slab objects >> unless they are from kmalloc or explicitly whitelisted, breaks KVM >> completely. >> >> This series fixes it by adding the two new usercopy arguments >> to kvm_init (more precisely to a new function kvm_init_usercopy, >> while kvm_init passes zeroes as a default). >> >> There's also another broken ioctl, KVM_XEN_HVM_CONFIG, but it is >> obsolete and not a big deal at all. >> >> I'm Ccing all submaintainers in case they have something similar >> going on in their kvm_arch and kvm_vcpu_arch structs. KVM has a >> pretty complex userspace API, so thorough with linux-next is highly >> recommended. > > I assume on s390x, at least > > kvm_arch_vcpu_ioctl_get_one_reg() and > kvm_arch_vcpu_ioctl_set_one_reg() > > have to be fixed. > > Christian, are you already looking into this? Not yet. I am in preparation for travel. > >> >> Many thanks to Thomas Gleixner for reporting this to me. >> >> Paolo >> >> Paolo Bonzini (2): >> KVM: allow setting a usercopy region in struct kvm_vcpu >> KVM: fix KVM_XEN_HVM_CONFIG ioctl >> >> arch/x86/include/asm/kvm_host.h | 3 +++ >> arch/x86/kvm/svm.c | 4 ++-- >> arch/x86/kvm/vmx.c | 4 ++-- >> arch/x86/kvm/x86.c | 17 ++++++++++++++--- >> include/linux/kvm_host.h | 13 +++++++++++-- >> virt/kvm/kvm_main.c | 13 ++++++++----- >> 6 files changed, 40 insertions(+), 14 deletions(-) >> > >
