Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 29 Aug 2018 16:36:55 +0200
From:   Radim Krcmar <rkrcmar@redhat.com>
To:     Liran Alon <liran.alon@oracle.com>
Cc:     Dan Carpenter <dan.carpenter@oracle.com>,
        Wanpeng Li <kernellwp@gmail.com>,
        LKML <linux-kernel@vger.kernel.org>, kvm <kvm@vger.kernel.org>,
        Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH] KVM: LAPIC: Fix pv ipis out-of-bounds access
Message-ID: <20180829143653.GB15829@flask>
References: <1535521943-5547-1-git-send-email-wanpengli@tencent.com>
 <A523C29C-C3E8-4FEF-8620-96365F774582@oracle.com>
 <20180829101205.jsp53e2wq7fc6ukd@mwanda>
 <20180829101822.qo3u7lsmghs3kcuf@mwanda>
 <CANRm+Cy9n=2Ssy_cEWRtnoQJczjdqB+m-dA6zesz75r0h532iA@mail.gmail.com>
 <20180829102910.rkyato47chayt22s@mwanda>
 <485CA660-9423-45B7-848F-49E3D13D5CBD@oracle.com>
 <20180829135539.GA15829@flask>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20180829135539.GA15829@flask>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

2018-08-29 15:55+0200, Radim Krcmar:
> 2018-08-29 13:43+0300, Liran Alon:
> > Why is “min” defined as “int” instead of “unsigned int”?
> > It represents the lowest APIC ID in bitmap so it can’t be negative…
> 
> Right,
> 
> I think the code would look better as something like (untested):
> 
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index 0cefba28c864..24fc84eb97d2 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -548,7 +548,7 @@ int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq,
>  }
>  
>  int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
> -    		    unsigned long ipi_bitmap_high, int min,
> +		    unsigned long ipi_bitmap_high, u32 min,
>  		    unsigned long icr, int op_64_bit)
>  {
>  	int i;
> @@ -557,6 +557,7 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
>  	struct kvm_lapic_irq irq = {0};
>  	int cluster_size = op_64_bit ? 64 : 32;
>  	int count = 0;
> +	unsigned long ipi_bitmap[2] = {ipi_bitmap_low, ipi_bitmap_high};

The patch is wrong, I missed the 32/64 bit cluster size.

It's salvageable with something like

  if (op_64_bit) {
  	ipi_bitmap[0] = ipi_bitmap_low;
  	ipi_bitmap[1] = ipi_bitmap_high;
  	ipi_bitmap_size = 128;
  } else {
  	ipi_bitmap[0] = (u32)ipi_bitmap_low | ipi_bitmap_high << 32;
  	ipi_bitmap_size = 64;
  }

>  
>  	irq.vector = icr & APIC_VECTOR_MASK;
>  	irq.delivery_mode = icr & APIC_MODE_MASK;
> @@ -571,16 +572,14 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
>  	rcu_read_lock();
>  	map = rcu_dereference(kvm->arch.apic_map);
>  
> -	/* Bits above cluster_size are masked in the caller.  */
> -	for_each_set_bit(i, &ipi_bitmap_low, BITS_PER_LONG) {
> -		vcpu = map->phys_map[min + i]->vcpu;
> -		count += kvm_apic_set_irq(vcpu, &irq, NULL);
> -	}
> +	if (min <= map->max_apic_id) {
> +		size_t ipi_bitmap_size = MIN(sizeof(ipi_bitmap) * 8,
> +		                             map->max_apic_id - min + 1);
> -	min += cluster_size;
> -	for_each_set_bit(i, &ipi_bitmap_high, BITS_PER_LONG) {
> -		vcpu = map->phys_map[min + i]->vcpu;
> -		count += kvm_apic_set_irq(vcpu, &irq, NULL);
> +		for_each_set_bit(i, ipi_bitmap, ipi_bitmap_size) {

and

  ... MIN(ipi_bitmap_size, map->max_apic_id - min + 1) ...

Not good, but could still be nicer than the alternatives.

> +			vcpu = map->phys_map[min + i]->vcpu;
> +			count += kvm_apic_set_irq(vcpu, &irq, NULL);
> +		}
>  	}
>  
>  	rcu_read_unlock();