Messages in this thread | | | Date | Sat, 30 May 2020 20:42:32 +0100 | From | Al Viro <> | Subject | Re: [PATCH 8/9] x86: kvm_hv_set_msr(): use __put_user() instead of 32bit __clear_user() |
| |
On Sat, May 30, 2020 at 12:20:54PM -0700, Linus Torvalds wrote: > On Sat, May 30, 2020 at 12:14 PM Al Viro <viro@zeniv.linux.org.uk> wrote: > > > > > And none of that code verifies that the end result is a user address. > > > > kvm_is_error_hva() is > > return addr >= PAGE_OFFSET; > > Ahh, that's what I missed. It won't work on other architectures, but > within x86 it's fine.
FWIW, we use virt/kvm on x86, powerpc, mips, s390 and arm64.
For x86 and powerpc the check is, AFAICS, OK (ppc kernel might start higher than PAGE_OFFSET, but not lower than it). For arm64... not sure - I'm not familiar with the virtual address space layout we use there. mips does *NOT* get that protection at all - there kvm_is_error_hva() is IS_ERR_VALUE() (thus the "at least on non-mips" upthread). And for s390 it's also IS_ERR_VALUE(), but that's an separate can of worms - there access_ok() is constant true; if we ever hit any of that code in virt/kvm while under KERNEL_DS, we are well and truly fucked there.
| |