FAILED: patch "[PATCH] KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent" failed to apply to 5.10-stable tree

PATCH [email protected] 2 participants 3 messages Jun 3, 2022 – Jun 20, 2022

Subsystems (3)

Stable branch x86 KVM x86

lore

Share & tools

lore

[email protected]

author maintainer

2022-06-03 15:15 UTC #0 lore raw

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From d22d2474e3953996f03528b84b7f52cc26a39403 Mon Sep 17 00:00:00 2001
From: Ashish Kalra <[email protected]>
Date: Mon, 16 May 2022 15:43:10 +0000
Subject: [PATCH] KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent
kernel data leak

For some sev ioctl interfaces, the length parameter that is passed maybe less than or equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP firmware returns. In this case, kmalloc will allocate memory that is the size of the input rather than the size of the data. Since PSP firmware doesn't fully overwrite the allocated buffer, these sev ioctl interface may return uninitialized kernel slab memory.

Reported-by Andy Nguyen <[email protected]>

Cc [email protected]

Fixes eaf78265a4ab3 ("KVM: SVM: Move SEV code to separate file")

Fixes 2c07ded06427d ("KVM: SVM: add support for SEV attestation command")

Fixes 4cfdd47d6d95a ("KVM: SVM: Add KVM_SEV SEND_START command")

Fixes d3d1af85e2c75 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command")

Fixes eba04b20e4861 ("KVM: x86: Account a variety of miscellaneous allocations")

Signed-off-by Ashish Kalra <[email protected]>

Reviewed-by Peter Gonda <[email protected]>

Message-Id: <[email protected]>

Signed-off-by Paolo Bonzini <[email protected]>

arch/x86/kvm/svm/sev.c +6 -6

index 655770522471..39f3dd005499 100644
@@ -688,7 +688,7 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
 		if (params.len > SEV_FW_BLOB_MAX_SIZE)
 			return -EINVAL;
 
-		blob = kmalloc(params.len, GFP_KERNEL_ACCOUNT);
+		blob = kzalloc(params.len, GFP_KERNEL_ACCOUNT);
 		if (!blob)
 			return -ENOMEM;

@@ -808,7 +808,7 @@ static int __sev_dbg_decrypt_user(struct kvm *kvm, unsigned long paddr,
 	if (!IS_ALIGNED(dst_paddr, 16) ||
 	    !IS_ALIGNED(paddr,     16) ||
 	    !IS_ALIGNED(size,      16)) {
-		tpage = (void *)alloc_page(GFP_KERNEL);
+		tpage = (void *)alloc_page(GFP_KERNEL | __GFP_ZERO);
 		if (!tpage)
 			return -ENOMEM;

@@ -1094,7 +1094,7 @@ static int sev_get_attestation_report(struct kvm *kvm, struct kvm_sev_cmd *argp)
 		if (params.len > SEV_FW_BLOB_MAX_SIZE)
 			return -EINVAL;
 
-		blob = kmalloc(params.len, GFP_KERNEL_ACCOUNT);
+		blob = kzalloc(params.len, GFP_KERNEL_ACCOUNT);
 		if (!blob)
 			return -ENOMEM;

@@ -1176,7 +1176,7 @@ static int sev_send_start(struct kvm *kvm, struct kvm_sev_cmd *argp)
 		return -EINVAL;
 
 	/* allocate the memory to hold the session data blob */
-	session_data = kmalloc(params.session_len, GFP_KERNEL_ACCOUNT);
+	session_data = kzalloc(params.session_len, GFP_KERNEL_ACCOUNT);
 	if (!session_data)
 		return -ENOMEM;

@@ -1300,11 +1300,11 @@ static int sev_send_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
 
 	/* allocate memory for header and transport buffer */
 	ret = -ENOMEM;
-	hdr = kmalloc(params.hdr_len, GFP_KERNEL_ACCOUNT);
+	hdr = kzalloc(params.hdr_len, GFP_KERNEL_ACCOUNT);
 	if (!hdr)
 		goto e_unpin;
 
-	trans_data = kmalloc(params.trans_len, GFP_KERNEL_ACCOUNT);
+	trans_data = kzalloc(params.trans_len, GFP_KERNEL_ACCOUNT);
 	if (!trans_data)
 		goto e_free_hdr;

Sudip Mukherjee

Reviewed-by Peter Gonda

2022-06-17 20:06 UTC #1 lore raw

Hi Greg,

Quoted 5 lines · On Fri, Jun 03, 2022 at 05:15:15PM +0200, [email protected] wrote:

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

Here is the backport along with eba04b20e486 ("KVM: x86: Account a variety of miscellaneous allocations") which was needed for easier backporting.

--
Regards
Sudip

From a32f2e2d390d929a371ea7baef2bad7e42d2d3ee Mon Sep 17 00:00:00 2001
From: Sean Christopherson <[email protected]>
Date: Tue, 30 Mar 2021 19:30:25 -0700
Subject: [PATCH 1/2] KVM: x86: Account a variety of miscellaneous allocations

commit eba04b20e4861d9bdbd8470a13c0c6e824521a36 upstream.

Switch to GFP_KERNEL_ACCOUNT for a handful of allocations that are clearly associated with a single task/VM.

Note, there are a several SEV allocations that aren't accounted, but those can (hopefully) be fixed by using the local stack for memory.

Signed-off-by Sean Christopherson <[email protected]>

Message-Id: <[email protected]>

Signed-off-by Paolo Bonzini <[email protected]>

[sudip: adjust context]

Signed-off-by Sudip Mukherjee <[email protected]>

---
 arch/x86/kvm/svm/nested.c | 4 ++--
 arch/x86/kvm/svm/sev.c    | 2 +-
 arch/x86/kvm/vmx/vmx.c    | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

arch/x86/kvm/svm/nested.c +2 -2

index 23910e6a3f011..e7feaa7910ab3 100644
@@ -1198,8 +1198,8 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
 		return -EINVAL;
 
 	ret  = -ENOMEM;
-	ctl  = kzalloc(sizeof(*ctl),  GFP_KERNEL);
-	save = kzalloc(sizeof(*save), GFP_KERNEL);
+	ctl  = kzalloc(sizeof(*ctl),  GFP_KERNEL_ACCOUNT);
+	save = kzalloc(sizeof(*save), GFP_KERNEL_ACCOUNT);
 	if (!ctl || !save)
 		goto out_free;

arch/x86/kvm/svm/sev.c +1 -1

index 6c82ef22985d9..a0c4da5f7d7fe 100644
@@ -537,7 +537,7 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
 		}
 
 		ret = -ENOMEM;
-		blob = kmalloc(params.len, GFP_KERNEL);
+		blob = kmalloc(params.len, GFP_KERNEL_ACCOUNT);
 		if (!blob)
 			goto e_free;

arch/x86/kvm/vmx/vmx.c +1 -1

index e729f65c67600..cc647dcc228b7 100644
@@ -619,7 +619,7 @@ static int hv_enable_direct_tlbflush(struct kvm_vcpu *vcpu)
 	 * evmcs in singe VM shares same assist page.
 	 */
 	if (!*p_hv_pa_pg)
-		*p_hv_pa_pg = kzalloc(PAGE_SIZE, GFP_KERNEL);
+		*p_hv_pa_pg = kzalloc(PAGE_SIZE, GFP_KERNEL_ACCOUNT);
 
 	if (!*p_hv_pa_pg)
 		return -ENOMEM;

Signature · 1 line

2.30.2

From 7479eecc9a8955aac994cad3ee5e6e123f0b2059 Mon Sep 17 00:00:00 2001
From: Ashish Kalra <[email protected]>
Date: Mon, 16 May 2022 15:43:10 +0000
Subject: [PATCH 2/2] KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent
kernel data leak

commit d22d2474e3953996f03528b84b7f52cc26a39403 upstream.

Reported-by Andy Nguyen <[email protected]>

Cc [email protected]

Fixes eaf78265a4ab3 ("KVM: SVM: Move SEV code to separate file")

Fixes 2c07ded06427d ("KVM: SVM: add support for SEV attestation command")

Fixes 4cfdd47d6d95a ("KVM: SVM: Add KVM_SEV SEND_START command")

Fixes d3d1af85e2c75 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command")

Fixes eba04b20e4861 ("KVM: x86: Account a variety of miscellaneous allocations")

Signed-off-by Ashish Kalra <[email protected]>

Reviewed-by Peter Gonda <[email protected]>

Message-Id: <[email protected]>

Signed-off-by Paolo Bonzini <[email protected]>

[sudip: adjust context]

Signed-off-by Sudip Mukherjee <[email protected]>

---
 arch/x86/kvm/svm/sev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

arch/x86/kvm/svm/sev.c +2 -2

index a0c4da5f7d7fe..7397cc449e2fc 100644
@@ -537,7 +537,7 @@ static int sev_launch_measure(struct kvm *kvm, struct kvm_sev_cmd *argp)
 		}
 
 		ret = -ENOMEM;
-		blob = kmalloc(params.len, GFP_KERNEL_ACCOUNT);
+		blob = kzalloc(params.len, GFP_KERNEL_ACCOUNT);
 		if (!blob)
 			goto e_free;

@@ -676,7 +676,7 @@ static int __sev_dbg_decrypt_user(struct kvm *kvm, unsigned long paddr,
 	if (!IS_ALIGNED(dst_paddr, 16) ||
 	    !IS_ALIGNED(paddr,     16) ||
 	    !IS_ALIGNED(size,      16)) {
-		tpage = (void *)alloc_page(GFP_KERNEL);
+		tpage = (void *)alloc_page(GFP_KERNEL | __GFP_ZERO);
 		if (!tpage)
 			return -ENOMEM;

Signature · 1 line

2.30.2

Greg KH

author maintainer

2022-06-20 10:07 UTC #2 lore raw

Quoted 11 lines · Sudip Mukherjee

Hi Greg,
Quoted 5 lines · On Fri, Jun 03, 2022 at 05:15:15PM +0200, [email protected] wrote:
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Here is the backport along with eba04b20e486 ("KVM: x86: Account a variety of miscellaneous allocations") which was needed for easier backporting.

Now queued up, thanks.

greg k-h