From: Greg Kroah-Hartman Date: Mon, 15 Aug 2022 12:55:48 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.15.61~55 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=443057951e0b3bb24c3fb132b2f9e0b8a2a20ccf;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch --- diff --git a/queue-4.14/kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch b/queue-4.14/kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch new file mode 100644 index 00000000000..be057f6845d --- /dev/null +++ b/queue-4.14/kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch @@ -0,0 +1,130 @@ +From foo@baz Mon Aug 15 02:54:39 PM CEST 2022 +From: Stefan Ghinea +Date: Wed, 10 Aug 2022 23:26:53 +0300 +Subject: KVM: Add infrastructure and macro to mark VM as bugged +To: stable@vger.kernel.org +Cc: Sean Christopherson , Isaku Yamahata , Paolo Bonzini , Stefan Ghinea +Message-ID: <20220810202655.32600-1-stefan.ghinea@windriver.com> + +From: Sean Christopherson + +commit 0b8f11737cffc1a406d1134b58687abc29d76b52 upstream + +Signed-off-by: Sean Christopherson +Signed-off-by: Isaku Yamahata +Reviewed-by: Paolo Bonzini +Message-Id: <3a0998645c328bf0895f1290e61821b70f048549.1625186503.git.isaku.yamahata@intel.com> +Signed-off-by: Paolo Bonzini +[SG: Adjusted context for kernel version 4.14] +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/kvm_host.h | 28 +++++++++++++++++++++++++++- + virt/kvm/kvm_main.c | 10 +++++----- + 2 files changed, 32 insertions(+), 6 deletions(-) + +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -127,6 +127,7 @@ static inline bool is_error_page(struct + #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQ_PENDING_TIMER 2 + #define KVM_REQ_UNHALT 3 ++#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQUEST_ARCH_BASE 8 + + #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \ +@@ -446,6 +447,7 @@ struct kvm { + struct kvm_stat_data **debugfs_stat_data; + struct srcu_struct srcu; + struct srcu_struct irq_srcu; ++ bool vm_bugged; + pid_t userspace_pid; + }; + +@@ -475,6 +477,31 @@ struct kvm { + #define vcpu_err(vcpu, fmt, ...) \ + kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) + ++bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); ++static inline void kvm_vm_bugged(struct kvm *kvm) ++{ ++ kvm->vm_bugged = true; ++ kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED); ++} ++ ++#define KVM_BUG(cond, kvm, fmt...) \ ++({ \ ++ int __ret = (cond); \ ++ \ ++ if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \ ++ kvm_vm_bugged(kvm); \ ++ unlikely(__ret); \ ++}) ++ ++#define KVM_BUG_ON(cond, kvm) \ ++({ \ ++ int __ret = (cond); \ ++ \ ++ if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \ ++ kvm_vm_bugged(kvm); \ ++ unlikely(__ret); \ ++}) ++ + static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) + { + return srcu_dereference_check(kvm->buses[idx], &kvm->srcu, +@@ -732,7 +759,6 @@ void kvm_put_guest_fpu(struct kvm_vcpu * + + void kvm_flush_remote_tlbs(struct kvm *kvm); + void kvm_reload_remote_mmus(struct kvm *kvm); +-bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); + + long kvm_arch_dev_ioctl(struct file *filp, + unsigned int ioctl, unsigned long arg); +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2660,7 +2660,7 @@ static long kvm_vcpu_ioctl(struct file * + struct kvm_fpu *fpu = NULL; + struct kvm_sregs *kvm_sregs = NULL; + +- if (vcpu->kvm->mm != current->mm) ++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) + return -EIO; + + if (unlikely(_IOC_TYPE(ioctl) != KVMIO)) +@@ -2864,7 +2864,7 @@ static long kvm_vcpu_compat_ioctl(struct + void __user *argp = compat_ptr(arg); + int r; + +- if (vcpu->kvm->mm != current->mm) ++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) + return -EIO; + + switch (ioctl) { +@@ -2922,7 +2922,7 @@ static long kvm_device_ioctl(struct file + { + struct kvm_device *dev = filp->private_data; + +- if (dev->kvm->mm != current->mm) ++ if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged) + return -EIO; + + switch (ioctl) { +@@ -3087,7 +3087,7 @@ static long kvm_vm_ioctl(struct file *fi + void __user *argp = (void __user *)arg; + int r; + +- if (kvm->mm != current->mm) ++ if (kvm->mm != current->mm || kvm->vm_bugged) + return -EIO; + switch (ioctl) { + case KVM_CREATE_VCPU: +@@ -3264,7 +3264,7 @@ static long kvm_vm_compat_ioctl(struct f + struct kvm *kvm = filp->private_data; + int r; + +- if (kvm->mm != current->mm) ++ if (kvm->mm != current->mm || kvm->vm_bugged) + return -EIO; + switch (ioctl) { + case KVM_GET_DIRTY_LOG: { diff --git a/queue-4.14/kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch b/queue-4.14/kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch new file mode 100644 index 00000000000..6deb411de5f --- /dev/null +++ b/queue-4.14/kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch @@ -0,0 +1,39 @@ +From foo@baz Mon Aug 15 02:54:39 PM CEST 2022 +From: Stefan Ghinea +Date: Wed, 10 Aug 2022 23:26:55 +0300 +Subject: KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() +To: stable@vger.kernel.org +Cc: Vitaly Kuznetsov , Paolo Bonzini , Stefan Ghinea +Message-ID: <20220810202655.32600-3-stefan.ghinea@windriver.com> + +From: Vitaly Kuznetsov + +commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream + +When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF +shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON() +instead of crashing the host. + +Signed-off-by: Vitaly Kuznetsov +Message-Id: <20220325132140.25650-3-vkuznets@redhat.com> +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/lapic.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -894,6 +894,10 @@ bool kvm_irq_delivery_to_apic_fast(struc + *r = -1; + + if (irq->shorthand == APIC_DEST_SELF) { ++ if (KVM_BUG_ON(!src, kvm)) { ++ *r = 0; ++ return true; ++ } + *r = kvm_apic_set_irq(src->vcpu, irq, dest_map); + return true; + } diff --git a/queue-4.14/kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch b/queue-4.14/kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch new file mode 100644 index 00000000000..0d22eef63f1 --- /dev/null +++ b/queue-4.14/kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch @@ -0,0 +1,43 @@ +From foo@baz Mon Aug 15 02:54:39 PM CEST 2022 +From: Stefan Ghinea +Date: Wed, 10 Aug 2022 23:26:54 +0300 +Subject: KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq +To: stable@vger.kernel.org +Cc: Vitaly Kuznetsov , Paolo Bonzini , Stefan Ghinea +Message-ID: <20220810202655.32600-2-stefan.ghinea@windriver.com> + +From: Vitaly Kuznetsov + +commit 7ec37d1cbe17d8189d9562178d8b29167fe1c31a upstream + +When KVM_CAP_HYPERV_SYNIC{,2} is activated, KVM already checks for +irqchip_in_kernel() so normally SynIC irqs should never be set. It is, +however, possible for a misbehaving VMM to write to SYNIC/STIMER MSRs +causing erroneous behavior. + +The immediate issue being fixed is that kvm_irq_delivery_to_apic() +(kvm_irq_delivery_to_apic_fast()) crashes when called with +'irq.shorthand = APIC_DEST_SELF' and 'src == NULL'. + +Signed-off-by: Vitaly Kuznetsov +Message-Id: <20220325132140.25650-2-vkuznets@redhat.com> +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/hyperv.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -317,6 +317,9 @@ static int synic_set_irq(struct kvm_vcpu + struct kvm_lapic_irq irq; + int ret, vector; + ++ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) ++ return -EINVAL; ++ + if (sint >= ARRAY_SIZE(synic->sint)) + return -EINVAL; + diff --git a/queue-4.14/series b/queue-4.14/series index aa983429346..c8df1d56bd7 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -166,3 +166,6 @@ dm-raid-fix-address-sanitizer-warning-in-raid_resume.patch dm-raid-fix-address-sanitizer-warning-in-raid_status.patch net_sched-cls_route-remove-from-list-when-handle-is-0.patch btrfs-reject-log-replay-if-there-is-unsupported-ro-compat-flag.patch +kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch +kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch +kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch