4.9-stable patches

added patches:
	kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch

diff --git a/queue-4.9/kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch b/queue-4.9/kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch
new file mode 100644 (file)
index 0000000..db9860d
--- /dev/null
+++ b/queue-4.9/kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch
@@ -0,0 +1,56 @@
+From foo@baz Mon Aug 16 09:26:03 PM CEST 2021
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 16 Aug 2021 16:02:32 +0200
+Subject: KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
+To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
+Cc: stable@vger.kernel.org, Maxim Levitsky <mlevitsk@redhat.com>
+Message-ID: <20210816140240.11399-4-pbonzini@redhat.com>
+
+From: Maxim Levitsky <mlevitsk@redhat.com>
+
+[ upstream commit 0f923e07124df069ba68d8bb12324398f4b6b709 ]
+
+* Invert the mask of bits that we pick from L2 in
+  nested_vmcb02_prepare_control
+
+* Invert and explicitly use VIRQ related bits bitmask in svm_clear_vintr
+
+This fixes a security issue that allowed a malicious L1 to run L2 with
+AVIC enabled, which allowed the L2 to exploit the uninitialized and enabled
+AVIC to read/write the host physical memory at some offsets.
+
+Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
+Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/svm.h |    2 ++
+ arch/x86/kvm/svm.c         |    6 +++++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/svm.h
++++ b/arch/x86/include/asm/svm.h
+@@ -113,6 +113,8 @@ struct __attribute__ ((__packed__)) vmcb
+ #define V_IGN_TPR_SHIFT 20
+ #define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
+ 
++#define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_TPR_MASK)
++
+ #define V_INTR_MASKING_SHIFT 24
+ #define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
+ 
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3048,7 +3048,11 @@ static bool nested_svm_vmrun(struct vcpu
+       svm->nested.intercept            = nested_vmcb->control.intercept;
+ 
+       svm_flush_tlb(&svm->vcpu);
+-      svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl | V_INTR_MASKING_MASK;
++      svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl &
++                      (V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK);
++
++      svm->vmcb->control.int_ctl |= V_INTR_MASKING_MASK;
++
+       if (nested_vmcb->control.int_ctl & V_INTR_MASKING_MASK)
+               svm->vcpu.arch.hflags |= HF_VINTR_MASK;
+       else

diff --git a/queue-4.9/series b/queue-4.9/series
index 255b3fbbb38ebebeb7a519bc5e48c855d70c3eca..40d636400e22e90e85dab7db9648d5acfd22d6ec 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -15,3 +15,4 @@ pci-msi-use-msi_mask_irq-in-pci_msi_shutdown.patch
 pci-msi-protect-msi_desc-masked-for-multi-msi.patch
 vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch
 mac80211-drop-data-frames-without-key-on-encrypted-links.patch
+kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch