Re: [PATCH 0/2] KVM: fixes for the kernel-hardening tree

2017-10-25 Thread Christian Borntraeger
On 10/25/2017 11:45 AM, David Hildenbrand wrote: > On 23.10.2017 16:15, Paolo Bonzini wrote: >> On 23/10/2017 14:39, Cornelia Huck wrote: >>> On Mon, 23 Oct 2017 11:52:51 +0200 >>> David Hildenbrand wrote: >>> On 21.10.2017 01:25, Paolo Bonzini wrote: > Two KVM ioctls (KVM_GET/SET_CPUID

Re: [PATCH 0/2] KVM: fixes for the kernel-hardening tree

2017-10-25 Thread David Hildenbrand
On 23.10.2017 16:15, Paolo Bonzini wrote: > On 23/10/2017 14:39, Cornelia Huck wrote: >> On Mon, 23 Oct 2017 11:52:51 +0200 >> David Hildenbrand wrote: >> >>> On 21.10.2017 01:25, Paolo Bonzini wrote: Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries field of struct k

Re: [PATCH 0/2] KVM: fixes for the kernel-hardening tree

2017-10-23 Thread Paolo Bonzini
On 23/10/2017 14:39, Cornelia Huck wrote: > On Mon, 23 Oct 2017 11:52:51 +0200 > David Hildenbrand wrote: > >> On 21.10.2017 01:25, Paolo Bonzini wrote: >>> Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries >>> field of struct kvm_vcpu_arch. Therefore, the new usercopy harden

Re: [PATCH 0/2] KVM: fixes for the kernel-hardening tree

2017-10-23 Thread Cornelia Huck
On Mon, 23 Oct 2017 11:52:51 +0200 David Hildenbrand wrote: > On 21.10.2017 01:25, Paolo Bonzini wrote: > > Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries > > field of struct kvm_vcpu_arch. Therefore, the new usercopy hardening > > work in linux-next, which forbids copies

Re: [PATCH 0/2] KVM: fixes for the kernel-hardening tree

2017-10-23 Thread Christian Borntraeger
On 10/23/2017 11:52 AM, David Hildenbrand wrote: > On 21.10.2017 01:25, Paolo Bonzini wrote: >> Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries >> field of struct kvm_vcpu_arch. Therefore, the new usercopy hardening >> work in linux-next, which forbids copies from and to sl

Re: [PATCH 0/2] KVM: fixes for the kernel-hardening tree

2017-10-23 Thread David Hildenbrand
On 21.10.2017 01:25, Paolo Bonzini wrote: > Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries > field of struct kvm_vcpu_arch. Therefore, the new usercopy hardening > work in linux-next, which forbids copies from and to slab objects > unless they are from kmalloc or explicitly

[PATCH 0/2] KVM: fixes for the kernel-hardening tree

2017-10-20 Thread Paolo Bonzini
Two KVM ioctls (KVM_GET/SET_CPUID2) directly access the cpuid_entries field of struct kvm_vcpu_arch. Therefore, the new usercopy hardening work in linux-next, which forbids copies from and to slab objects unless they are from kmalloc or explicitly whitelisted, breaks KVM completely. This series f