From patchwork Mon May 13 22:25:08 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andre Przywara X-Patchwork-Id: 16889 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-ye0-f200.google.com (mail-ye0-f200.google.com [209.85.213.200]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 20C1B25E17 for ; Mon, 13 May 2013 22:26:56 +0000 (UTC) Received: by mail-ye0-f200.google.com with SMTP id r9sf7665783yen.3 for ; Mon, 13 May 2013 15:26:09 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:mime-version:x-beenthere:x-received:received-spf :x-received:x-forwarded-to:x-forwarded-for:delivered-to:x-received :received-spf:x-received:from:to:cc:subject:date:message-id:x-mailer :x-gm-message-state:x-original-sender :x-original-authentication-results:precedence:mailing-list:list-id :x-google-group-id:list-post:list-help:list-archive:list-unsubscribe; bh=f8D9ez9zg3PFxDIpsS/qPsAcvEhWbp5D7WaV6WQA8KI=; b=bZZ1ZeE6JwAgSeRu1ADZYbY3twmiLtNVr3wmbPz1YjS6QVKU7F6APeoMtKduU0Bchv 9K4z/PWg5BLIwVjQhBqLuHjlv40NIc00jCPtyg//cBLjd45Wq0Be9XR9GVziM7dCRorG BC0xjY5Vu3BeOorbmPsTS6mTzBeBfXsVl+evj0ReNTgrtu/rfDFLEkcUdEXCp/gtZvtv JjoUNse4jamZvdsphLkx5RC+NlI2R8HM3etpsXHwUC/RdQj0uydGW5Pdmmj8iEH8n7Az n/mq3DOG/T3HtJPNLmCZ6+DhL6umvtCn4NuFlDRtaZiw+IUPdPyjeRz+pjGhMl+593aM MKXw== X-Received: by 10.58.232.170 with SMTP id tp10mr11826926vec.7.1368483969442; Mon, 13 May 2013 15:26:09 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.49.35.238 with SMTP id l14ls3097659qej.13.gmail; Mon, 13 May 2013 15:26:09 -0700 (PDT) X-Received: by 10.52.156.65 with SMTP id wc1mr16957233vdb.84.1368483969243; Mon, 13 May 2013 15:26:09 -0700 (PDT) Received: from mail-vb0-x22a.google.com (mail-vb0-x22a.google.com [2607:f8b0:400c:c02::22a]) by mx.google.com with ESMTPS id n8si9410940vck.78.2013.05.13.15.26.09 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 13 May 2013 15:26:09 -0700 (PDT) Received-SPF: neutral (google.com: 2607:f8b0:400c:c02::22a is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) client-ip=2607:f8b0:400c:c02::22a; Received: by mail-vb0-f42.google.com with SMTP id w16so5659829vbf.15 for ; Mon, 13 May 2013 15:26:09 -0700 (PDT) X-Received: by 10.220.189.9 with SMTP id dc9mr19755980vcb.8.1368483969137; Mon, 13 May 2013 15:26:09 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patches@linaro.org Received: by 10.220.217.15 with SMTP id hk15csp37140vcb; Mon, 13 May 2013 15:26:08 -0700 (PDT) X-Received: by 10.60.79.68 with SMTP id h4mr10353170oex.39.1368483968452; Mon, 13 May 2013 15:26:08 -0700 (PDT) Received: from mail-ob0-x22b.google.com (mail-ob0-x22b.google.com [2607:f8b0:4003:c01::22b]) by mx.google.com with ESMTPS id fi9si17207783obb.186.2013.05.13.15.26.08 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 13 May 2013 15:26:08 -0700 (PDT) Received-SPF: neutral (google.com: 2607:f8b0:4003:c01::22b is neither permitted nor denied by best guess record for domain of andre.przywara@linaro.org) client-ip=2607:f8b0:4003:c01::22b; Received: by mail-ob0-f171.google.com with SMTP id ef5so4407812obb.2 for ; Mon, 13 May 2013 15:26:08 -0700 (PDT) X-Received: by 10.60.155.137 with SMTP id vw9mr14355552oeb.81.1368483967752; Mon, 13 May 2013 15:26:07 -0700 (PDT) Received: from localhost.localdomain (g225195109.adsl.alicedsl.de. [92.225.195.109]) by mx.google.com with ESMTPSA id jt9sm18609230obc.0.2013.05.13.15.26.05 for (version=TLSv1.2 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 13 May 2013 15:26:07 -0700 (PDT) From: Andre Przywara To: cdall@cs.columbia.edu Cc: marc.zyngier@arm.com, kvmarm@lists.cs.columbia.edu, linux-arm-kernel@lists.infradead.org, patches@linaro.org, Andre Przywara Subject: [PATCH v3] ARM: KVM: prevent NULL pointer dereferences with KVM VCPU ioctl Date: Tue, 14 May 2013 00:25:08 +0200 Message-Id: <1368483908-22274-1-git-send-email-andre.przywara@linaro.org> X-Mailer: git-send-email 1.7.12.1 X-Gm-Message-State: ALoCoQl4KPx7DgPH1mJrwhl50Mrriy3Gsk2Dsf8HZrOJuaeM7955Ow1YesCzLDPcELvclx1xFMEW X-Original-Sender: andre.przywara@linaro.org X-Original-Authentication-Results: mx.google.com; spf=neutral (google.com: 2607:f8b0:400c:c02::22a is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Precedence: list Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org List-ID: X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , Some ARM KVM VCPU ioctls require the vCPU to be properly initialized with the KVM_ARM_VCPU_INIT ioctl before being used with further requests. KVM_RUN checks whether this initialization has been done, but other ioctls do not. Namely KVM_GET_REG_LIST will dereference an array with index -1 without initialization and thus leads to a kernel oops. Fix this by adding checks before executing the ioctl handlers. Changes from v1: * moved check into a static function with a meaningful name Changes from v2: * moved function into a header file and marked it as inline Signed-off-by: Andre Przywara --- arch/arm/include/asm/kvm_coproc.h | 9 +++++++++ arch/arm/kvm/arm.c | 10 ++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/arch/arm/include/asm/kvm_coproc.h b/arch/arm/include/asm/kvm_coproc.h index 4917c2f7..80d0082 100644 --- a/arch/arm/include/asm/kvm_coproc.h +++ b/arch/arm/include/asm/kvm_coproc.h @@ -39,6 +39,15 @@ unsigned long kvm_arm_num_guest_msrs(struct kvm_vcpu *vcpu); int kvm_arm_copy_msrindices(struct kvm_vcpu *vcpu, u64 __user *uindices); void kvm_coproc_table_init(void); +/* + * Some ioctls require initialization by KVM_ARM_VCPU_INIT first, check + * this with this function to avoid NULL pointer dereference + */ +static inline int kvm_vcpu_initialized(struct kvm_vcpu *vcpu) +{ + return vcpu->arch.target >= 0; +} + struct kvm_one_reg; int kvm_arm_copy_coproc_indices(struct kvm_vcpu *vcpu, u64 __user *uindices); int kvm_arm_coproc_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *); diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c index 37d216d..6800293 100644 --- a/arch/arm/kvm/arm.c +++ b/arch/arm/kvm/arm.c @@ -508,8 +508,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run) int ret; sigset_t sigsaved; - /* Make sure they initialize the vcpu with KVM_ARM_VCPU_INIT */ - if (unlikely(vcpu->arch.target < 0)) + if (unlikely(!kvm_vcpu_initialized(vcpu))) return -ENOEXEC; ret = kvm_vcpu_first_run_init(vcpu); @@ -710,6 +709,10 @@ long kvm_arch_vcpu_ioctl(struct file *filp, case KVM_SET_ONE_REG: case KVM_GET_ONE_REG: { struct kvm_one_reg reg; + + if (unlikely(!kvm_vcpu_initialized(vcpu))) + return -ENOEXEC; + if (copy_from_user(®, argp, sizeof(reg))) return -EFAULT; if (ioctl == KVM_SET_ONE_REG) @@ -722,6 +725,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, struct kvm_reg_list reg_list; unsigned n; + if (unlikely(!kvm_vcpu_initialized(vcpu))) + return -ENOEXEC; + if (copy_from_user(®_list, user_list, sizeof(reg_list))) return -EFAULT; n = reg_list.n;