5.17-stable patches

added patches:
	kvm-x86-mmu-fix-null-pointer-dereference-on-guest-invpcid.patch

diff --git a/queue-5.17/kvm-x86-mmu-fix-null-pointer-dereference-on-guest-invpcid.patch b/queue-5.17/kvm-x86-mmu-fix-null-pointer-dereference-on-guest-invpcid.patch
new file mode 100644 (file)
index 0000000..1175400
--- /dev/null
+++ b/queue-5.17/kvm-x86-mmu-fix-null-pointer-dereference-on-guest-invpcid.patch
@@ -0,0 +1,56 @@
+From 9f46c187e2e680ecd9de7983e4d081c3391acc76 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Fri, 20 May 2022 13:48:11 -0400
+Subject: KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 9f46c187e2e680ecd9de7983e4d081c3391acc76 upstream.
+
+With shadow paging enabled, the INVPCID instruction results in a call
+to kvm_mmu_invpcid_gva.  If INVPCID is executed with CR0.PG=0, the
+invlpg callback is not set and the result is a NULL pointer dereference.
+Fix it trivially by checking for mmu->invlpg before every call.
+
+There are other possibilities:
+
+- check for CR0.PG, because KVM (like all Intel processors after P5)
+  flushes guest TLB on CR0.PG changes so that INVPCID/INVLPG are a
+  nop with paging disabled
+
+- check for EFER.LMA, because KVM syncs and flushes when switching
+  MMU contexts outside of 64-bit mode
+
+All of these are tricky, go for the simple solution.  This is CVE-2022-1789.
+
+Reported-by: Yongkang Jia <kangel@zju.edu.cn>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[fix conflict due to missing b9e5603c2a3accbadfec570ac501a54431a6bdba]
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/mmu/mmu.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -5416,14 +5416,16 @@ void kvm_mmu_invpcid_gva(struct kvm_vcpu
+       uint i;
+ 
+       if (pcid == kvm_get_active_pcid(vcpu)) {
+-              mmu->invlpg(vcpu, gva, mmu->root_hpa);
++              if (mmu->invlpg)
++                      mmu->invlpg(vcpu, gva, mmu->root_hpa);
+               tlb_flush = true;
+       }
+ 
+       for (i = 0; i < KVM_MMU_NUM_PREV_ROOTS; i++) {
+               if (VALID_PAGE(mmu->prev_roots[i].hpa) &&
+                   pcid == kvm_get_pcid(vcpu, mmu->prev_roots[i].pgd)) {
+-                      mmu->invlpg(vcpu, gva, mmu->prev_roots[i].hpa);
++                      if (mmu->invlpg)
++                              mmu->invlpg(vcpu, gva, mmu->prev_roots[i].hpa);
+                       tlb_flush = true;
+               }
+       }

diff --git a/queue-5.17/series b/queue-5.17/series
index eece0fd2d5d251adadc5000c6b5e7c4f8e9ee8e5..47d31afeaa31cd82ffd0b339be4edee6c0983bc2 100644 (file)
--- a/queue-5.17/series
+++ b/queue-5.17/series
@@ -1 +1,2 @@
 hid-amd_sfh-add-support-for-sensor-discovery.patch
+kvm-x86-mmu-fix-null-pointer-dereference-on-guest-invpcid.patch