releases/3.10.40/kvm-ioapic-fix-assignment-of-ioapic-rtc_status.pending_eoi-cve-2014-0155.patch

   1 From 5678de3f15010b9022ee45673f33bcfc71d47b60 Mon Sep 17 00:00:00 2001
   2 From: Paolo Bonzini <pbonzini@redhat.com>
   3 Date: Fri, 28 Mar 2014 20:41:50 +0100
   4 Subject: KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)
   5
   6 From: Paolo Bonzini <pbonzini@redhat.com>
   7
   8 commit 5678de3f15010b9022ee45673f33bcfc71d47b60 upstream.
   9
  10 QE reported that they got the BUG_ON in ioapic_service to trigger.
  11 I cannot reproduce it, but there are two reasons why this could happen.
  12
  13 The less likely but also easiest one, is when kvm_irq_delivery_to_apic
  14 does not deliver to any APIC and returns -1.
  15
  16 Because irqe.shorthand == 0, the kvm_for_each_vcpu loop in that
  17 function is never reached.  However, you can target the similar loop in
  18 kvm_irq_delivery_to_apic_fast; just program a zero logical destination
  19 address into the IOAPIC, or an out-of-range physical destination address.
  20
  21 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  virt/kvm/ioapic.c |    2 +-
  26  1 file changed, 1 insertion(+), 1 deletion(-)
  27
  28 --- a/virt/kvm/ioapic.c
  29 +++ b/virt/kvm/ioapic.c
  30 @@ -306,7 +306,7 @@ static int ioapic_deliver(struct kvm_ioa
  31                 BUG_ON(ioapic->rtc_status.pending_eoi != 0);
  32                 ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe,
  33                                 ioapic->rtc_status.dest_map);
  34 -               ioapic->rtc_status.pending_eoi = ret;
  35 +               ioapic->rtc_status.pending_eoi = (ret < 0 ? 0 : ret);
  36         } else
  37                 ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe, NULL);
  38