From ae73bf7da8615d426986b65a6422270fd5a95e66 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 20 Nov 2023 16:31:06 +0100 Subject: [PATCH] 4.14-stable patches added patches: kvm-x86-ignore-msr_amd64_tw_cfg-access.patch media-venus-hfi-add-checks-to-perform-sanity-on-queue-pointers.patch randstruct-fix-gcc-plugin-performance-mode-to-stay-in-group.patch --- ...m-x86-ignore-msr_amd64_tw_cfg-access.patch | 78 +++++++++++++++++++ ...-to-perform-sanity-on-queue-pointers.patch | 50 ++++++++++++ ...in-performance-mode-to-stay-in-group.patch | 59 ++++++++++++++ queue-4.14/series | 3 + 4 files changed, 190 insertions(+) create mode 100644 queue-4.14/kvm-x86-ignore-msr_amd64_tw_cfg-access.patch create mode 100644 queue-4.14/media-venus-hfi-add-checks-to-perform-sanity-on-queue-pointers.patch create mode 100644 queue-4.14/randstruct-fix-gcc-plugin-performance-mode-to-stay-in-group.patch diff --git a/queue-4.14/kvm-x86-ignore-msr_amd64_tw_cfg-access.patch b/queue-4.14/kvm-x86-ignore-msr_amd64_tw_cfg-access.patch new file mode 100644 index 00000000000..606b67936a3 --- /dev/null +++ b/queue-4.14/kvm-x86-ignore-msr_amd64_tw_cfg-access.patch @@ -0,0 +1,78 @@ +From 2770d4722036d6bd24bcb78e9cd7f6e572077d03 Mon Sep 17 00:00:00 2001 +From: "Maciej S. Szmigiero" +Date: Thu, 19 Oct 2023 18:06:57 +0200 +Subject: KVM: x86: Ignore MSR_AMD64_TW_CFG access + +From: Maciej S. Szmigiero + +commit 2770d4722036d6bd24bcb78e9cd7f6e572077d03 upstream. + +Hyper-V enabled Windows Server 2022 KVM VM cannot be started on Zen1 Ryzen +since it crashes at boot with SYSTEM_THREAD_EXCEPTION_NOT_HANDLED + +STATUS_PRIVILEGED_INSTRUCTION (in other words, because of an unexpected #GP +in the guest kernel). + +This is because Windows tries to set bit 8 in MSR_AMD64_TW_CFG and can't +handle receiving a #GP when doing so. + +Give this MSR the same treatment that commit 2e32b7190641 +("x86, kvm: Add MSR_AMD64_BU_CFG2 to the list of ignored MSRs") gave +MSR_AMD64_BU_CFG2 under justification that this MSR is baremetal-relevant +only. +Although apparently it was then needed for Linux guests, not Windows as in +this case. + +With this change, the aforementioned guest setup is able to finish booting +successfully. + +This issue can be reproduced either on a Summit Ridge Ryzen (with +just "-cpu host") or on a Naples EPYC (with "-cpu host,stepping=1" since +EPYC is ordinarily stepping 2). + +Alternatively, userspace could solve the problem by using MSR filters, but +forcing every userspace to define a filter isn't very friendly and doesn't +add much, if any, value. The only potential hiccup is if one of these +"baremetal-only" MSRs ever requires actual emulation and/or has F/M/S +specific behavior. But if that happens, then KVM can still punt *that* +handling to userspace since userspace MSR filters "win" over KVM's default +handling. + +Signed-off-by: Maciej S. Szmigiero +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1ce85d9c7c9e9632393816cf19c902e0a3f411f1.1697731406.git.maciej.szmigiero@oracle.com +[sean: call out MSR filtering alternative] +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/msr-index.h | 1 + + arch/x86/kvm/x86.c | 2 ++ + 2 files changed, 3 insertions(+) + +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -414,6 +414,7 @@ + #define MSR_AMD64_OSVW_STATUS 0xc0010141 + #define MSR_AMD64_LS_CFG 0xc0011020 + #define MSR_AMD64_DC_CFG 0xc0011022 ++#define MSR_AMD64_TW_CFG 0xc0011023 + + #define MSR_AMD64_DE_CFG 0xc0011029 + #define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT 1 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -2304,6 +2304,7 @@ int kvm_set_msr_common(struct kvm_vcpu * + case MSR_AMD64_PATCH_LOADER: + case MSR_AMD64_BU_CFG2: + case MSR_AMD64_DC_CFG: ++ case MSR_AMD64_TW_CFG: + case MSR_F15H_EX_CFG: + break; + +@@ -2598,6 +2599,7 @@ int kvm_get_msr_common(struct kvm_vcpu * + case MSR_AMD64_BU_CFG2: + case MSR_IA32_PERF_CTL: + case MSR_AMD64_DC_CFG: ++ case MSR_AMD64_TW_CFG: + case MSR_F15H_EX_CFG: + msr_info->data = 0; + break; diff --git a/queue-4.14/media-venus-hfi-add-checks-to-perform-sanity-on-queue-pointers.patch b/queue-4.14/media-venus-hfi-add-checks-to-perform-sanity-on-queue-pointers.patch new file mode 100644 index 00000000000..1a3e5b54189 --- /dev/null +++ b/queue-4.14/media-venus-hfi-add-checks-to-perform-sanity-on-queue-pointers.patch @@ -0,0 +1,50 @@ +From 5e538fce33589da6d7cb2de1445b84d3a8a692f7 Mon Sep 17 00:00:00 2001 +From: Vikash Garodia +Date: Thu, 10 Aug 2023 07:55:01 +0530 +Subject: media: venus: hfi: add checks to perform sanity on queue pointers + +From: Vikash Garodia + +commit 5e538fce33589da6d7cb2de1445b84d3a8a692f7 upstream. + +Read and write pointers are used to track the packet index in the memory +shared between video driver and firmware. There is a possibility of OOB +access if the read or write pointer goes beyond the queue memory size. +Add checks for the read and write pointer to avoid OOB access. + +Cc: stable@vger.kernel.org +Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") +Signed-off-by: Vikash Garodia +Signed-off-by: Stanimir Varbanov +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -220,6 +220,11 @@ static int venus_write_queue(struct venu + + new_wr_idx = wr_idx + dwords; + wr_ptr = (u32 *)(queue->qmem.kva + (wr_idx << 2)); ++ ++ if (wr_ptr < (u32 *)queue->qmem.kva || ++ wr_ptr > (u32 *)(queue->qmem.kva + queue->qmem.size - sizeof(*wr_ptr))) ++ return -EINVAL; ++ + if (new_wr_idx < qsize) { + memcpy(wr_ptr, packet, dwords << 2); + } else { +@@ -287,6 +292,11 @@ static int venus_read_queue(struct venus + } + + rd_ptr = (u32 *)(queue->qmem.kva + (rd_idx << 2)); ++ ++ if (rd_ptr < (u32 *)queue->qmem.kva || ++ rd_ptr > (u32 *)(queue->qmem.kva + queue->qmem.size - sizeof(*rd_ptr))) ++ return -EINVAL; ++ + dwords = *rd_ptr >> 2; + if (!dwords) + return -EINVAL; diff --git a/queue-4.14/randstruct-fix-gcc-plugin-performance-mode-to-stay-in-group.patch b/queue-4.14/randstruct-fix-gcc-plugin-performance-mode-to-stay-in-group.patch new file mode 100644 index 00000000000..82b18360172 --- /dev/null +++ b/queue-4.14/randstruct-fix-gcc-plugin-performance-mode-to-stay-in-group.patch @@ -0,0 +1,59 @@ +From 381fdb73d1e2a48244de7260550e453d1003bb8e Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Fri, 6 Oct 2023 21:09:28 -0700 +Subject: randstruct: Fix gcc-plugin performance mode to stay in group + +From: Kees Cook + +commit 381fdb73d1e2a48244de7260550e453d1003bb8e upstream. + +The performance mode of the gcc-plugin randstruct was shuffling struct +members outside of the cache-line groups. Limit the range to the +specified group indexes. + +Cc: linux-hardening@vger.kernel.org +Cc: stable@vger.kernel.org +Reported-by: Lukas Loidolt +Closes: https://lore.kernel.org/all/f3ca77f0-e414-4065-83a5-ae4c4d25545d@student.tuwien.ac.at +Fixes: 313dd1b62921 ("gcc-plugins: Add the randstruct plugin") +Signed-off-by: Kees Cook +Signed-off-by: Greg Kroah-Hartman +--- + scripts/gcc-plugins/randomize_layout_plugin.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/scripts/gcc-plugins/randomize_layout_plugin.c ++++ b/scripts/gcc-plugins/randomize_layout_plugin.c +@@ -209,12 +209,14 @@ static void partition_struct(tree *field + + static void performance_shuffle(tree *newtree, unsigned long length, ranctx *prng_state) + { +- unsigned long i, x; ++ unsigned long i, x, index; + struct partition_group size_group[length]; + unsigned long num_groups = 0; + unsigned long randnum; + + partition_struct(newtree, length, (struct partition_group *)&size_group, &num_groups); ++ ++ /* FIXME: this group shuffle is currently a no-op. */ + for (i = num_groups - 1; i > 0; i--) { + struct partition_group tmp; + randnum = ranval(prng_state) % (i + 1); +@@ -224,11 +226,14 @@ static void performance_shuffle(tree *ne + } + + for (x = 0; x < num_groups; x++) { +- for (i = size_group[x].start + size_group[x].length - 1; i > size_group[x].start; i--) { ++ for (index = size_group[x].length - 1; index > 0; index--) { + tree tmp; ++ ++ i = size_group[x].start + index; + if (DECL_BIT_FIELD_TYPE(newtree[i])) + continue; +- randnum = ranval(prng_state) % (i + 1); ++ randnum = ranval(prng_state) % (index + 1); ++ randnum += size_group[x].start; + // we could handle this case differently if desired + if (DECL_BIT_FIELD_TYPE(newtree[randnum])) + continue; diff --git a/queue-4.14/series b/queue-4.14/series index b8b7a9616d7..b07b17b57f7 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -24,3 +24,6 @@ media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch media-vivid-avoid-integer-overflow.patch gfs2-ignore-negated-quota-changes.patch pwm-fix-double-shift-bug.patch +media-venus-hfi-add-checks-to-perform-sanity-on-queue-pointers.patch +randstruct-fix-gcc-plugin-performance-mode-to-stay-in-group.patch +kvm-x86-ignore-msr_amd64_tw_cfg-access.patch -- 2.47.3