From 40020466c2ad15eb3c97aa834560fa1426824c57 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 18 Oct 2024 12:40:00 +0200 Subject: [PATCH] 5.4-stable patches added patches: kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch --- ...ast_boosted_vcpu-in-kvm_vcpu_on_spin.patch | 97 +++++++++++++++++++ queue-5.4/series | 1 + 2 files changed, 98 insertions(+) create mode 100644 queue-5.4/kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch diff --git a/queue-5.4/kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch b/queue-5.4/kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch new file mode 100644 index 00000000000..3b8aaac3fa6 --- /dev/null +++ b/queue-5.4/kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch @@ -0,0 +1,97 @@ +From 49f683b41f28918df3e51ddc0d928cb2e934ccdb Mon Sep 17 00:00:00 2001 +From: Breno Leitao +Date: Fri, 10 May 2024 02:23:52 -0700 +Subject: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() + +From: Breno Leitao + +commit 49f683b41f28918df3e51ddc0d928cb2e934ccdb upstream. + +Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the +loads and stores are atomic. In the extremely unlikely scenario the +compiler tears the stores, it's theoretically possible for KVM to attempt +to get a vCPU using an out-of-bounds index, e.g. if the write is split +into multiple 8-bit stores, and is paired with a 32-bit load on a VM with +257 vCPUs: + + CPU0 CPU1 + last_boosted_vcpu = 0xff; + + (last_boosted_vcpu = 0x100) + last_boosted_vcpu[15:8] = 0x01; + i = (last_boosted_vcpu = 0x1ff) + last_boosted_vcpu[7:0] = 0x00; + + vcpu = kvm->vcpu_array[0x1ff]; + +As detected by KCSAN: + + BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm] + + write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16: + kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm + handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel + vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? + arch/x86/kvm/vmx/vmx.c:6606) kvm_intel + vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm + kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm + kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm + __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) + __x64_sys_ioctl (fs/ioctl.c:890) + x64_sys_call (arch/x86/entry/syscall_64.c:33) + do_syscall_64 (arch/x86/entry/common.c:?) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + + read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4: + kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm + handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel + vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:? + arch/x86/kvm/vmx/vmx.c:6606) kvm_intel + vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm + kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm + kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm + __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890) + __x64_sys_ioctl (fs/ioctl.c:890) + x64_sys_call (arch/x86/entry/syscall_64.c:33) + do_syscall_64 (arch/x86/entry/common.c:?) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + + value changed: 0x00000012 -> 0x00000000 + +Fixes: 217ece6129f2 ("KVM: use yield_to instead of sleep in kvm_vcpu_on_spin") +Cc: stable@vger.kernel.org +Signed-off-by: Breno Leitao +Link: https://lore.kernel.org/r/20240510092353.2261824-1-leitao@debian.org +Signed-off-by: Sean Christopherson +Signed-off-by: Saeed Mirzamohammadi +Signed-off-by: Greg Kroah-Hartman +--- + virt/kvm/kvm_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2714,12 +2714,13 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m + { + struct kvm *kvm = me->kvm; + struct kvm_vcpu *vcpu; +- int last_boosted_vcpu = me->kvm->last_boosted_vcpu; ++ int last_boosted_vcpu; + int yielded = 0; + int try = 3; + int pass; + int i; + ++ last_boosted_vcpu = READ_ONCE(kvm->last_boosted_vcpu); + kvm_vcpu_set_in_spin_loop(me, true); + /* + * We boost the priority of a VCPU that is runnable but not +@@ -2749,7 +2750,7 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m + + yielded = kvm_vcpu_yield_to(vcpu); + if (yielded > 0) { +- kvm->last_boosted_vcpu = i; ++ WRITE_ONCE(kvm->last_boosted_vcpu, i); + break; + } else if (yielded < 0) { + try--; diff --git a/queue-5.4/series b/queue-5.4/series index 644558096ef..019897ca268 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -358,3 +358,4 @@ pci-add-function-0-dma-alias-quirk-for-glenfly-arise-chip.patch fat-fix-uninitialized-variable.patch mm-swapfile-skip-hugetlb-pages-for-unuse_vma.patch wifi-mac80211-fix-potential-key-use-after-free.patch +kvm-fix-a-data-race-on-last_boosted_vcpu-in-kvm_vcpu_on_spin.patch -- 2.47.3