From patchwork Wed May 8 22:28:06 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andre Przywara X-Patchwork-Id: 16802 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-qa0-f72.google.com (mail-qa0-f72.google.com [209.85.216.72]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 30AAF238FB for ; Wed, 8 May 2013 22:29:23 +0000 (UTC) Received: by mail-qa0-f72.google.com with SMTP id i13sf3092266qae.7 for ; Wed, 08 May 2013 15:29:01 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:mime-version:x-beenthere:x-received:received-spf :x-received:x-forwarded-to:x-forwarded-for:delivered-to:x-received :received-spf:x-received:from:to:cc:subject:date:message-id:x-mailer :x-gm-message-state:x-original-sender :x-original-authentication-results:precedence:mailing-list:list-id :x-google-group-id:list-post:list-help:list-archive:list-unsubscribe; bh=GsGERPj4WltOF/9FcuI+OBvGbvr08h/3M+r8wOVV9vg=; b=YGz5ZhUe4UuRjmZUVxP7722q4ZB6WgxQ5PpBOIVGO64lNQlkbABhC5V/jO7NMrctKP 3w0NEpZc+NN6r8SEe8ajNTWHiDO3TE5W+2xmzFOdZdo7hRO+z4ybxdQD8HKRTvOm6r7+ jzUsj8ElHbh59upD6ibUVOMWPutJ9tyClBlAORyvREKU1N+PE0bvkDK/Rf+MwxPmrrPc IUB0HGtbvlGpiQ9k2Oo+ea9HH8/6Ozf+jTE5nTBfjMSzxHEr28GDFkCoILRfbphnazKa 4LPwxcRU3+v3C+HdMcDCYYTbmgqsLf4CwV03XJ1iSfv/3Vja0anU7iPglDd4gSZ5WLJh R3aA== X-Received: by 10.224.165.130 with SMTP id i2mr8401923qay.2.1368052140964; Wed, 08 May 2013 15:29:00 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.49.0.163 with SMTP id 3ls1177243qef.58.gmail; Wed, 08 May 2013 15:29:00 -0700 (PDT) X-Received: by 10.220.172.2 with SMTP id j2mr6119049vcz.17.1368052140756; Wed, 08 May 2013 15:29:00 -0700 (PDT) Received: from mail-vc0-f176.google.com (mail-vc0-f176.google.com [209.85.220.176]) by mx.google.com with ESMTPS id ec8si272785vdb.85.2013.05.08.15.29.00 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 08 May 2013 15:29:00 -0700 (PDT) Received-SPF: neutral (google.com: 209.85.220.176 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) client-ip=209.85.220.176; Received: by mail-vc0-f176.google.com with SMTP id ib11so2169889vcb.21 for ; Wed, 08 May 2013 15:29:00 -0700 (PDT) X-Received: by 10.52.66.101 with SMTP id e5mr5243935vdt.57.1368052140634; Wed, 08 May 2013 15:29:00 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patches@linaro.org Received: by 10.58.127.98 with SMTP id nf2csp28984veb; Wed, 8 May 2013 15:28:59 -0700 (PDT) X-Received: by 10.60.45.8 with SMTP id i8mr2926772oem.78.1368052139684; Wed, 08 May 2013 15:28:59 -0700 (PDT) Received: from mail-oa0-f44.google.com (mail-oa0-f44.google.com [209.85.219.44]) by mx.google.com with ESMTPS id zb4si228554obb.8.2013.05.08.15.28.59 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 08 May 2013 15:28:59 -0700 (PDT) Received-SPF: neutral (google.com: 209.85.219.44 is neither permitted nor denied by best guess record for domain of andre.przywara@linaro.org) client-ip=209.85.219.44; Received: by mail-oa0-f44.google.com with SMTP id n12so2716441oag.3 for ; Wed, 08 May 2013 15:28:58 -0700 (PDT) X-Received: by 10.60.118.196 with SMTP id ko4mr2890076oeb.2.1368052138913; Wed, 08 May 2013 15:28:58 -0700 (PDT) Received: from localhost.localdomain (f048094010.adsl.alicedsl.de. [78.48.94.10]) by mx.google.com with ESMTPSA id c20sm427529oez.4.2013.05.08.15.28.56 for (version=TLSv1.2 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 08 May 2013 15:28:58 -0700 (PDT) From: Andre Przywara To: cdall@cs.columbia.edu, marc.zyngier@arm.com Cc: kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, patches@linaro.org, Andre Przywara Subject: [PATCH v2] ARM: KVM: prevent NULL pointer dereferences with KVM VCPU ioctl Date: Thu, 9 May 2013 00:28:06 +0200 Message-Id: <1368052086-25059-1-git-send-email-andre.przywara@linaro.org> X-Mailer: git-send-email 1.7.12.1 X-Gm-Message-State: ALoCoQm8jvWW3rbOPqkoOhN5TBi/j8T3MpXVU2Clba3DFinHaMVcEA7Gdysy/zx2HZFB/OBDoH+U X-Original-Sender: andre.przywara@linaro.org X-Original-Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.220.176 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Precedence: list Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org List-ID: X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , Some ARM KVM VCPU ioctls require the vCPU to be properly initialized with the KVM_ARM_VCPU_INIT ioctl before being used with further requests. KVM_RUN checks whether this initialization has been done, but other ioctls do not. Namely KVM_GET_REG_LIST will dereference an array with index -1 without initialization and thus leads to a kernel oops. Fix this by adding checks before executing the ioctl handlers. Changes from v1: * moved check into a static function with a meaningful name Signed-off-by: Andre Przywara --- arch/arm/kvm/arm.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c index c1fe498..b73b587 100644 --- a/arch/arm/kvm/arm.c +++ b/arch/arm/kvm/arm.c @@ -676,6 +676,15 @@ static void vcpu_pause(struct kvm_vcpu *vcpu) wait_event_interruptible(*wq, !vcpu->arch.pause); } +/* + * Some ioctls require initialization by KVM_ARM_VCPU_INIT first, check + * this with this function + */ +static int kvm_vcpu_initialized(struct kvm_vcpu *vcpu) +{ + return vcpu->arch.target >= 0; +} + /** * kvm_arch_vcpu_ioctl_run - the main VCPU run function to execute guest code * @vcpu: The VCPU pointer @@ -692,8 +701,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run) int ret; sigset_t sigsaved; - /* Make sure they initialize the vcpu with KVM_ARM_VCPU_INIT */ - if (unlikely(vcpu->arch.target < 0)) + if (unlikely(!kvm_vcpu_initialized(vcpu))) return -ENOEXEC; ret = kvm_vcpu_first_run_init(vcpu); @@ -893,6 +901,10 @@ long kvm_arch_vcpu_ioctl(struct file *filp, case KVM_SET_ONE_REG: case KVM_GET_ONE_REG: { struct kvm_one_reg reg; + + if (unlikely(!kvm_vcpu_initialized(vcpu))) + return -ENOEXEC; + if (copy_from_user(®, argp, sizeof(reg))) return -EFAULT; if (ioctl == KVM_SET_ONE_REG) @@ -905,6 +917,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, struct kvm_reg_list reg_list; unsigned n; + if (unlikely(!kvm_vcpu_initialized(vcpu))) + return -ENOEXEC; + if (copy_from_user(®_list, user_list, sizeof(reg_list))) return -EFAULT; n = reg_list.n;