Date: Sun, 6 Oct 2024 15:01:46 GMT From: Ed Maste <emaste@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: f8db6fb90e73 - stable/14 - vmm: avoid potential KASSERT kernel panic in vm_handle_db Message-ID: <202410061501.496F1k0Q046927@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/14 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=f8db6fb90e739293d6d72310fa554ede072f8232 commit f8db6fb90e739293d6d72310fa554ede072f8232 Author: Pierre Pronchery <pierre@freebsdfoundation.org> AuthorDate: 2024-07-25 14:40:35 +0000 Commit: Ed Maste <emaste@FreeBSD.org> CommitDate: 2024-10-06 15:01:24 +0000 vmm: avoid potential KASSERT kernel panic in vm_handle_db If the guest VM emits the exit code VM_EXITCODE_DB the kernel will execute the function named vm_handle_db. If the value of rsp is not page aligned and if rsp+sizeof(uint64_t) spans across two pages, the function vm_copy_setup will need two structs vm_copyinfo to prepare the copy operation. For instance is rsp value is 0xFFC, two vm_copyinfo objects are needed: * address=0xFFC, len=4 * address=0x1000, len=4 The vulnerability was addressed by commit 51fda658baa ("vmm: Properly handle writes spanning across two pages in vm_handle_db"). Still, replace the KASSERT with an error return as a more defensive approach. Reported by: Synacktiv Reviewed by markj, emaste Security: HYP-09 Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46133 (cherry picked from commit d19fa9c1b72bc52e51524abcc59ad844012ec365) --- sys/amd64/vmm/vmm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/amd64/vmm/vmm.c b/sys/amd64/vmm/vmm.c index ef4c7a9af2ea..677dcd05b9b2 100644 --- a/sys/amd64/vmm/vmm.c +++ b/sys/amd64/vmm/vmm.c @@ -2786,7 +2786,8 @@ vm_copy_setup(struct vcpu *vcpu, struct vm_guest_paging *paging, nused = 0; remaining = len; while (remaining > 0) { - KASSERT(nused < num_copyinfo, ("insufficient vm_copyinfo")); + if (nused >= num_copyinfo) + return (EFAULT); error = vm_gla2gpa(vcpu, paging, gla, prot, &gpa, fault); if (error || *fault) return (error);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202410061501.496F1k0Q046927>