From: Greg Kroah-Hartman Date: Fri, 19 Apr 2013 20:59:21 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.8.9~21^2~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0efe4ef0c262f911378855937bd4f1ac189fa889;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: hfsplus-fix-potential-overflow-in-hfsplus_file_truncate.patch kvm-x86-convert-msr_kvm_system_time-to-use-gfn_to_hva_cache-functions-cve-2013-1797.patch kvm-x86-fix-for-buffer-overflow-in-handling-of-msr_kvm_system_time-cve-2013-1796.patch --- diff --git a/queue-3.0/hfsplus-fix-potential-overflow-in-hfsplus_file_truncate.patch b/queue-3.0/hfsplus-fix-potential-overflow-in-hfsplus_file_truncate.patch new file mode 100644 index 00000000000..941ea01a84f --- /dev/null +++ b/queue-3.0/hfsplus-fix-potential-overflow-in-hfsplus_file_truncate.patch @@ -0,0 +1,34 @@ +From 12f267a20aecf8b84a2a9069b9011f1661c779b4 Mon Sep 17 00:00:00 2001 +From: Vyacheslav Dubeyko +Date: Wed, 17 Apr 2013 15:58:33 -0700 +Subject: hfsplus: fix potential overflow in hfsplus_file_truncate() + +From: Vyacheslav Dubeyko + +commit 12f267a20aecf8b84a2a9069b9011f1661c779b4 upstream. + +Change a u32 to loff_t hfsplus_file_truncate(). + +Signed-off-by: Vyacheslav Dubeyko +Cc: Christoph Hellwig +Cc: Al Viro +Cc: Hin-Tak Leung +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfsplus/extents.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/hfsplus/extents.c ++++ b/fs/hfsplus/extents.c +@@ -499,7 +499,7 @@ void hfsplus_file_truncate(struct inode + struct address_space *mapping = inode->i_mapping; + struct page *page; + void *fsdata; +- u32 size = inode->i_size; ++ loff_t size = inode->i_size; + int res; + + res = pagecache_write_begin(NULL, mapping, size, 0, diff --git a/queue-3.0/kvm-x86-convert-msr_kvm_system_time-to-use-gfn_to_hva_cache-functions-cve-2013-1797.patch b/queue-3.0/kvm-x86-convert-msr_kvm_system_time-to-use-gfn_to_hva_cache-functions-cve-2013-1797.patch new file mode 100644 index 00000000000..95476a88818 --- /dev/null +++ b/queue-3.0/kvm-x86-convert-msr_kvm_system_time-to-use-gfn_to_hva_cache-functions-cve-2013-1797.patch @@ -0,0 +1,137 @@ +From 0b79459b482e85cb7426aa7da683a9f2c97aeae1 Mon Sep 17 00:00:00 2001 +From: Andy Honig +Date: Wed, 20 Feb 2013 14:48:10 -0800 +Subject: KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) + +From: Andy Honig + +commit 0b79459b482e85cb7426aa7da683a9f2c97aeae1 upstream. + +There is a potential use after free issue with the handling of +MSR_KVM_SYSTEM_TIME. If the guest specifies a GPA in a movable or removable +memory such as frame buffers then KVM might continue to write to that +address even after it's removed via KVM_SET_USER_MEMORY_REGION. KVM pins +the page in memory so it's unlikely to cause an issue, but if the user +space component re-purposes the memory previously used for the guest, then +the guest will be able to corrupt that memory. + +Tested: Tested against kvmclock unit test + +Signed-off-by: Andrew Honig +Signed-off-by: Marcelo Tosatti +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/x86/include/asm/kvm_host.h | 4 ++-- + arch/x86/kvm/x86.c | 39 ++++++++++++++------------------------- + 2 files changed, 16 insertions(+), 27 deletions(-) + +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -391,8 +391,8 @@ struct kvm_vcpu_arch { + gpa_t time; + struct pvclock_vcpu_time_info hv_clock; + unsigned int hw_tsc_khz; +- unsigned int time_offset; +- struct page *time_page; ++ struct gfn_to_hva_cache pv_time; ++ bool pv_time_enabled; + u64 last_guest_tsc; + u64 last_kernel_ns; + u64 last_tsc_nsec; +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1073,7 +1073,6 @@ static int kvm_guest_time_update(struct + { + unsigned long flags; + struct kvm_vcpu_arch *vcpu = &v->arch; +- void *shared_kaddr; + unsigned long this_tsc_khz; + s64 kernel_ns, max_kernel_ns; + u64 tsc_timestamp; +@@ -1109,7 +1108,7 @@ static int kvm_guest_time_update(struct + + local_irq_restore(flags); + +- if (!vcpu->time_page) ++ if (!vcpu->pv_time_enabled) + return 0; + + /* +@@ -1167,14 +1166,9 @@ static int kvm_guest_time_update(struct + */ + vcpu->hv_clock.version += 2; + +- shared_kaddr = kmap_atomic(vcpu->time_page, KM_USER0); +- +- memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock, +- sizeof(vcpu->hv_clock)); +- +- kunmap_atomic(shared_kaddr, KM_USER0); +- +- mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT); ++ kvm_write_guest_cached(v->kvm, &vcpu->pv_time, ++ &vcpu->hv_clock, ++ sizeof(vcpu->hv_clock)); + return 0; + } + +@@ -1464,10 +1458,7 @@ static int kvm_pv_enable_async_pf(struct + + static void kvmclock_reset(struct kvm_vcpu *vcpu) + { +- if (vcpu->arch.time_page) { +- kvm_release_page_dirty(vcpu->arch.time_page); +- vcpu->arch.time_page = NULL; +- } ++ vcpu->arch.pv_time_enabled = false; + } + + int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data) +@@ -1527,6 +1518,7 @@ int kvm_set_msr_common(struct kvm_vcpu * + break; + case MSR_KVM_SYSTEM_TIME_NEW: + case MSR_KVM_SYSTEM_TIME: { ++ u64 gpa_offset; + kvmclock_reset(vcpu); + + vcpu->arch.time = data; +@@ -1536,21 +1528,17 @@ int kvm_set_msr_common(struct kvm_vcpu * + if (!(data & 1)) + break; + +- /* ...but clean it before doing the actual write */ +- vcpu->arch.time_offset = data & ~(PAGE_MASK | 1); ++ gpa_offset = data & ~(PAGE_MASK | 1); + + /* Check that the address is 32-byte aligned. */ +- if (vcpu->arch.time_offset & +- (sizeof(struct pvclock_vcpu_time_info) - 1)) ++ if (gpa_offset & (sizeof(struct pvclock_vcpu_time_info) - 1)) + break; + +- vcpu->arch.time_page = +- gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT); +- +- if (is_error_page(vcpu->arch.time_page)) { +- kvm_release_page_clean(vcpu->arch.time_page); +- vcpu->arch.time_page = NULL; +- } ++ if (kvm_gfn_to_hva_cache_init(vcpu->kvm, ++ &vcpu->arch.pv_time, data & ~1ULL)) ++ vcpu->arch.pv_time_enabled = false; ++ else ++ vcpu->arch.pv_time_enabled = true; + break; + } + case MSR_KVM_ASYNC_PF_EN: +@@ -6257,6 +6245,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu * + if (!zalloc_cpumask_var(&vcpu->arch.wbinvd_dirty_mask, GFP_KERNEL)) + goto fail_free_mce_banks; + ++ vcpu->arch.pv_time_enabled = false; + kvm_async_pf_hash_reset(vcpu); + + return 0; diff --git a/queue-3.0/kvm-x86-fix-for-buffer-overflow-in-handling-of-msr_kvm_system_time-cve-2013-1796.patch b/queue-3.0/kvm-x86-fix-for-buffer-overflow-in-handling-of-msr_kvm_system_time-cve-2013-1796.patch new file mode 100644 index 00000000000..e0399be1f2b --- /dev/null +++ b/queue-3.0/kvm-x86-fix-for-buffer-overflow-in-handling-of-msr_kvm_system_time-cve-2013-1796.patch @@ -0,0 +1,42 @@ +From c300aa64ddf57d9c5d9c898a64b36877345dd4a9 Mon Sep 17 00:00:00 2001 +From: Andy Honig +Date: Mon, 11 Mar 2013 09:34:52 -0700 +Subject: KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) + +From: Andy Honig + +commit c300aa64ddf57d9c5d9c898a64b36877345dd4a9 upstream. + +If the guest sets the GPA of the time_page so that the request to update the +time straddles a page then KVM will write onto an incorrect page. The +write is done byusing kmap atomic to get a pointer to the page for the time +structure and then performing a memcpy to that page starting at an offset +that the guest controls. Well behaved guests always provide a 32-byte aligned +address, however a malicious guest could use this to corrupt host kernel +memory. + +Tested: Tested against kvmclock unit test. + +Signed-off-by: Andrew Honig +Signed-off-by: Marcelo Tosatti +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1539,6 +1539,11 @@ int kvm_set_msr_common(struct kvm_vcpu * + /* ...but clean it before doing the actual write */ + vcpu->arch.time_offset = data & ~(PAGE_MASK | 1); + ++ /* Check that the address is 32-byte aligned. */ ++ if (vcpu->arch.time_offset & ++ (sizeof(struct pvclock_vcpu_time_info) - 1)) ++ break; ++ + vcpu->arch.time_page = + gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT); + diff --git a/queue-3.0/series b/queue-3.0/series index 8d7e100f858..bd150b29f4f 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -3,3 +3,6 @@ revert-8021q-fix-a-potential-use-after-free.patch can-sja1000-fix-handling-on-dt-properties-on-little-endian-systems.patch hugetlbfs-add-swap-entry-check-in-follow_hugetlb_page.patch kernel-signal.c-stop-info-leak-via-the-tkill-and-the-tgkill-syscalls.patch +hfsplus-fix-potential-overflow-in-hfsplus_file_truncate.patch +kvm-x86-fix-for-buffer-overflow-in-handling-of-msr_kvm_system_time-cve-2013-1796.patch +kvm-x86-convert-msr_kvm_system_time-to-use-gfn_to_hva_cache-functions-cve-2013-1797.patch