On Thu, Oct 26 2017 at 3:45:46 pm BST, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote: > On x86, ARM and s390, struct kvm_vcpu_arch has a usercopy region > taht is read and written by the KVM_GET/SET_CPUID2 ioctls (x86) > or KVM_GET/SET_ONE_REG (ARM/s390). Without whitelisting the area, > KVM is completely broken on those architectures with usercopy hardening > enabled. > > For now, allow writing to the entire struct on all architectures. > The KVM tree will not refine this to an architecture-specific > subset of struct kvm_vcpu_arch. > > Cc: kernel-hardening@xxxxxxxxxxxxxxxxxx > Cc: Kees Cook <keescook@xxxxxxxxxxxx> > Cc: Christian Borntraeger <borntraeger@xxxxxxxxxx> > Cc: Christoffer Dall <cdall@xxxxxxxxxx> > Cc: Radim Krčmář <rkrcmar@xxxxxxxxxx> > Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Acked-by: Marc Zyngier <marc.zyngier@xxxxxxx> M. -- Jazz is not dead. It just smells funny.
