Re: [PATCH] kvm: Ensure writes to the coalesced MMIO ring are within bounds

[Will Deacon]

On Wed, Sep 18, 2019 at 03:41:40PM +0200, Paolo Bonzini wrote:
> On 18/09/19 15:15, Will Deacon wrote:
> > When records are written to the coalesced MMIO ring in response to a
> > vCPU MMIO exit, the 'ring->last' field is used to index the ring buffer
> > page. Although we hold the 'kvm->ring_lock' at this point, the ring
> > structure is mapped directly into the host userspace and can therefore
> > be modified to point at arbitrary pages within the kernel.
> > 
> > Since this shouldn't happen in normal operation, simply bound the index
> > by KVM_COALESCED_MMIO_MAX to contain the accesses within the ring buffer
> > page.
> > 
> > Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> > Cc: Paolo Bonzini <pbonzini@xxxxxxxxxx>
> > Cc: <stable@xxxxxxxxxx> # 5.2.y
> > Fixes: 5f94c1741bdc ("KVM: Add coalesced MMIO support (common part)")
> > Reported-by: Bill Creasey <bcreasey@xxxxxxxxxx>
> > Signed-off-by: Will Deacon <will@xxxxxxxxxx>
> > ---
> > 
> > I think there are some other fixes kicking around for this, but they
> > still rely on 'ring->last' being stable, which isn't necessarily the
> > case. I'll send the -stable backport for kernels prior to 5.2 once this
> > hits mainline.
> 
> Google's patch, which checks if ring->last is not in range and fails
> with -EOPNOTSUPP if not, is slightly better.  I'll send it in a second
> and Cc you (and also send it as a pull request to Linus).

Okey doke, as long as it gets fixed! My minor concerns with the error-checking
variant are:

  * Whether or not you need a READ_ONCE to prevent the compiler potentially
    reloading 'ring->last' after validation

  * Whether or not this could be part of a spectre-v1 gadget

so, given that I don't think the malicious host deserves an error code if it
starts writing the 'last' index, I went with the "obviously safe" version.
But up to you.

Will