[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH V5 1/4] x86/mm: Add array_index_nospec to guest provided index values


  • To: Jan Beulich <jbeulich@xxxxxxxx>
  • From: Alexandru Stefan ISAILA <aisaila@xxxxxxxxxxxxxxx>
  • Date: Fri, 20 Dec 2019 09:09:17 +0000
  • Accept-language: en-US
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=bitdefender.com; dmarc=pass action=none header.from=bitdefender.com; dkim=pass header.d=bitdefender.com; arc=none
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X3/XmNoph0au7WlfGN8UItE6S2pMPARsSsrkW6sVfNQ=; b=UZJW63VzOU+nHqLJz+K1T4QekHUC597UE2Manl+4fnree7cZ5sL1zpB+RO3jD5PBKvUrRBPejg6sULPWV72r9ry6l2/cXjNw70wHaqQZRne9G6rLHlSFcBG8lvBfHujUg4tK1w33OL4sJY32j18wwzpXpdtOYm8P7kkfjulquysKUFsYIHkoBU+DuWPtPqP9Ve4ewc+5dyjJmJebb4DHvV2KrfAMYQWNt50feM2tpvhMabRreNgFrKPmUVv4jZlF+nFflJ1N1lH7O6iTh8PN/KDPUHSczhtONbcLydIJJsmOpbLelvlYIBnCE6RFNDxQIovIzMCUlp1CQLZ/Y3qOtg==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UwDKRcYptpQkMFnqWH5IvY0o76ltdCFDDihnyIpzeQ7AjcQVQiicQ5a3VuBQ7cBij1jT4P4VOLkaQd+wHvU0bqwUts/fo3QdSSDC+NdRmYa+Y/4nYkGMIdEecTusgi7P67kYLyK8WDzDDedBK2dgIaDfMUbzQVnE2Z+TTIcMz10N/QUeXFUMJIjfdCZs1vaCzcpqeH9VxdiKiR8GYunkqG4D8Sefj9LeB6/elvd02AlTx572o1rMCLRT4J5f/ReMAvj7+NPbYVVR7LHJGlaiTfxqokolxyT1+OOFAgPVkhGDRG6q2dX/IbOO0zhJPUXh+oUHcw/Mu1t85+oN3Ev3tQ==
  • Authentication-results: spf=none (sender IP is ) smtp.mailfrom=aisaila@xxxxxxxxxxxxxxx;
  • Cc: Petre Ovidiu PIRCALABU <ppircalabu@xxxxxxxxxxxxxxx>, Kevin Tian <kevin.tian@xxxxxxxxx>, Tamas K Lengyel <tamas@xxxxxxxxxxxxx>, Wei Liu <wl@xxxxxxx>, Razvan COJOCARU <rcojocaru@xxxxxxxxxxxxxxx>, George Dunlap <george.dunlap@xxxxxxxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Jun Nakajima <jun.nakajima@xxxxxxxxx>, "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>
  • Delivery-date: Fri, 20 Dec 2019 09:09:29 +0000
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
  • Thread-index: AQHVtlCv9fBx8h7blUeN6Fd8ih9YqafBRckAgAF344A=
  • Thread-topic: [PATCH V5 1/4] x86/mm: Add array_index_nospec to guest provided index values


On 19.12.2019 12:43, Jan Beulich wrote:
> On 19.12.2019 10:42, Alexandru Stefan ISAILA wrote:
>> This patch aims to sanitize indexes, potentially guest provided
>> values, for altp2m_eptp[] and altp2m_p2m[] arrays.
>>
>> Requested-by: Jan Beulich <jbeulich@xxxxxxxx>
>> Signed-off-by: Alexandru Isaila <aisaila@xxxxxxxxxxxxxxx>
>> ---
>> CC: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
>> CC: Tamas K Lengyel <tamas@xxxxxxxxxxxxx>
>> CC: Petre Pircalabu <ppircalabu@xxxxxxxxxxxxxxx>
>> CC: George Dunlap <george.dunlap@xxxxxxxxxxxxx>
>> CC: Jan Beulich <jbeulich@xxxxxxxx>
>> CC: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
>> CC: Wei Liu <wl@xxxxxxx>
>> CC: "Roger Pau Monné" <roger.pau@xxxxxxxxxx>
>> CC: Jun Nakajima <jun.nakajima@xxxxxxxxx>
>> CC: Kevin Tian <kevin.tian@xxxxxxxxx>
>> ---
>> Changes since V4:
>>      - Change bounds check from MAX_EPTP to MAX_ALTP2M
>>      - Move array_index_nospec() closer to the bounds check.
>> ---
>>   xen/arch/x86/mm/mem_access.c | 15 +++++++++------
>>   xen/arch/x86/mm/p2m.c        | 20 ++++++++++++++------
>>   2 files changed, 23 insertions(+), 12 deletions(-)
>>
>> diff --git a/xen/arch/x86/mm/mem_access.c b/xen/arch/x86/mm/mem_access.c
>> index 320b9fe621..33e379db8f 100644
>> --- a/xen/arch/x86/mm/mem_access.c
>> +++ b/xen/arch/x86/mm/mem_access.c
>> @@ -367,10 +367,11 @@ long p2m_set_mem_access(struct domain *d, gfn_t gfn, 
>> uint32_t nr,
>>       if ( altp2m_idx )
>>       {
>>           if ( altp2m_idx >= MAX_ALTP2M ||

Ok, so have if ( altp2m_idx >=  min(ARRAY_SIZE(d->arch.altp2m_eptp), 
MAX_EPTP) ||
here and then...

>> -             d->arch.altp2m_eptp[altp2m_idx] == mfn_x(INVALID_MFN) )
>> +             d->arch.altp2m_eptp[array_index_nospec(altp2m_idx, 
>> MAX_ALTP2M)] ==

have MAX_EPTP here and ...

> 
> As implied by a reply to v4, this is still latently buggy: There's
> no guarantee anyone will notice the issue here when bumping
> MAX_ALTP2M past MAX_EPTP. The only future proof thing to do here
> is, as suggested, using some form of min(MAX_ALTP2M, MAX_EPTP) in
> the actual bounds check. Then each array access itself can be made
> use the correct bound. In fact you'd probably have noticed this if
> you had made use of array_access_nospec() where possible (which
> also would help readability) - apparently not here, but ... >
>> +             mfn_x(INVALID_MFN) )
>>               return -EINVAL;
>>   
>> -        ap2m = d->arch.altp2m_p2m[altp2m_idx];
>> +        ap2m = d->arch.altp2m_p2m[array_index_nospec(altp2m_idx, 
>> MAX_ALTP2M)];

MAX_ALTP2M here ?


Alex
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.