mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-09-18 22:14:16 +00:00
985bb51f17
There are multiple pKVM memory transitions where the state of a page is not cross-checked from the completer's PoV for performance reasons. For example, if a page is PKVM_PAGE_OWNED from the initiator's PoV, we should be guaranteed by construction that it is PKVM_NOPAGE for everybody else, hence allowing us to save a page-table lookup. When it was introduced, hyp_ack_unshare() followed that logic and bailed out without checking the PKVM_PAGE_SHARED_BORROWED state in the hypervisor's stage-1. This was correct as we could safely assume that all host-initiated shares were directed at the hypervisor at the time. But with the introduction of other types of shares (e.g. for FF-A or non-protected guests), it is now very much required to cross check this state to prevent the host from running __pkvm_host_unshare_hyp() on a page shared with TZ or a non-protected guest. Thankfully, if an attacker were to try this, the hyp_unmap() call from hyp_complete_unshare() would fail, hence causing to WARN() from __do_unshare() with the host lock held, which is fatal. But this is fragile at best, and can hardly be considered a security measure. Let's just do the right thing and always check the state from hyp_ack_unshare(). Signed-off-by: Quentin Perret <qperret@google.com> Acked-by: Will Deacon <will@kernel.org> Link: https://lore.kernel.org/r/20241128154406.602875-1-qperret@google.com Signed-off-by: Oliver Upton <oliver.upton@linux.dev> |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| cache.S | ||
| debug-sr.c | ||
| early_alloc.c | ||
| ffa.c | ||
| gen-hyprel.c | ||
| host.S | ||
| hyp-init.S | ||
| hyp-main.c | ||
| hyp-smp.c | ||
| hyp.lds.S | ||
| list_debug.c | ||
| Makefile | ||
| mem_protect.c | ||
| mm.c | ||
| page_alloc.c | ||
| pkvm.c | ||
| psci-relay.c | ||
| setup.c | ||
| stacktrace.c | ||
| switch.c | ||
| sys_regs.c | ||
| sysreg-sr.c | ||
| timer-sr.c | ||
| tlb.c | ||