misc: do not use u64 to represent host pointers

To ensure that struct sizes are the same on 32-bit and 64-bit, various
kernel APIs use __u64 (Rust u64) to represent userspace pointers.
Userspace is expected to cast pointers to __u64 before passing them to
the kernel, and cast kernel-provided __u64 to a pointer before using
them.  However, various safe APIs in Cloud Hypervisor took
caller-provided u64 values and passed them to syscalls that interpret
them as userspace addresses.  Therefore, passing bad u64 values would
cause memory disclosure or corruption.

Fix the bug by using usize and pointer types as appropriate.  To make
soundness of the code easier to reason about, the PCI code gains a new
MmapRegion abstraction that ensures the validity of pointers.  The rest
of the code already has an MmapRegion abstraction it can use.  To avoid
having to reason about whether something is keeping the MmapRegion
alive, reference counting is added.  MmapRegion cannot hold references
to other objects, so the reference counting cannot introduce cycles.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

hypervisor/src/kvm/mod.rs

@@ -723,8 +723,8 @@ impl vm::Vm for KvmVm {
         &self,
         slot: u32,
         guest_phys_addr: u64,
-        memory_size: u64,
-        userspace_addr: u64,
+        memory_size: usize,
+        userspace_addr: *mut u8,
         readonly: bool,
         log_dirty_pages: bool,
     ) -> vm::Result<()> {
@@ -741,8 +741,8 @@ impl vm::Vm for KvmVm {
         let mut region = kvm_userspace_memory_region {
             slot,
             guest_phys_addr,
-            memory_size,
-            userspace_addr,
+            memory_size: memory_size as u64,
+            userspace_addr: userspace_addr as usize as u64,
             flags,
         };
 
@@ -787,8 +787,8 @@ impl vm::Vm for KvmVm {
         &self,
         slot: u32,
         guest_phys_addr: u64,
-        memory_size: u64,
-        userspace_addr: u64,
+        memory_size: usize,
+        userspace_addr: *mut u8,
         readonly: bool,
         log_dirty_pages: bool,
     ) -> vm::Result<()> {
@@ -805,8 +805,8 @@ impl vm::Vm for KvmVm {
         let mut region = kvm_userspace_memory_region {
             slot,
             guest_phys_addr,
-            memory_size,
-            userspace_addr,
+            memory_size: memory_size as u64,
+            userspace_addr: userspace_addr as usize as u64,
             flags,
         };
 

hypervisor/src/mshv/mod.rs

@@ -1886,8 +1886,8 @@ impl vm::Vm for MshvVm {
         &self,
         _slot: u32,
         guest_phys_addr: u64,
-        memory_size: u64,
-        userspace_addr: u64,
+        memory_size: usize,
+        userspace_addr: *mut u8,
         readonly: bool,
         _log_dirty_pages: bool,
     ) -> vm::Result<()> {
@@ -1899,8 +1899,8 @@ impl vm::Vm for MshvVm {
         let user_memory_region = mshv_user_mem_region {
             flags,
             guest_pfn: guest_phys_addr >> PAGE_SHIFT,
-            size: memory_size,
-            userspace_addr,
+            size: memory_size.try_into().unwrap(),
+            userspace_addr: (userspace_addr as usize).try_into().unwrap(),
             ..Default::default()
         };
         // No matter read only or not we keep track the slots.
@@ -1930,8 +1930,8 @@ impl vm::Vm for MshvVm {
         &self,
         _slot: u32,
         guest_phys_addr: u64,
-        memory_size: u64,
-        userspace_addr: u64,
+        memory_size: usize,
+        userspace_addr: *mut u8,
         readonly: bool,
         _log_dirty_pages: bool,
     ) -> vm::Result<()> {
@@ -1943,8 +1943,8 @@ impl vm::Vm for MshvVm {
         let user_memory_region = mshv_user_mem_region {
             flags,
             guest_pfn: guest_phys_addr >> PAGE_SHIFT,
-            size: memory_size,
-            userspace_addr,
+            size: memory_size.try_into().unwrap(),
+            userspace_addr: (userspace_addr as usize).try_into().unwrap(),
             ..Default::default()
         };
         // Remove the corresponding entry from "self.dirty_log_slots" if needed

hypervisor/src/vm.rs

@@ -345,8 +345,8 @@ pub trait Vm: Send + Sync + Any {
         &self,
         slot: u32,
         guest_phys_addr: u64,
-        memory_size: u64,
-        userspace_addr: u64,
+        memory_size: usize,
+        userspace_addr: *mut u8,
         readonly: bool,
         log_dirty_pages: bool,
     ) -> Result<()>;
@@ -359,8 +359,8 @@ pub trait Vm: Send + Sync + Any {
         &self,
         slot: u32,
         guest_phys_addr: u64,
-        memory_size: u64,
-        userspace_addr: u64,
+        memory_size: usize,
+        userspace_addr: *mut u8,
         readonly: bool,
         log_dirty_pages: bool,
     ) -> Result<()>;