From 6e84e55034198aa572745da8754ef16f69d26ceb Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 15 Aug 2022 14:56:03 +0200 Subject: [PATCH] 5.4-stable patches added patches: kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch --- ...cture-and-macro-to-mark-vm-as-bugged.patch | 130 ++++++++++++++++++ ...nce-in-kvm_irq_delivery_to_apic_fast.patch | 39 ++++++ ...before-attempting-to-set-a-synic-irq.patch | 43 ++++++ queue-5.4/series | 3 + 4 files changed, 215 insertions(+) create mode 100644 queue-5.4/kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch create mode 100644 queue-5.4/kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch create mode 100644 queue-5.4/kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch diff --git a/queue-5.4/kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch b/queue-5.4/kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch new file mode 100644 index 00000000000..ebd33328b48 --- /dev/null +++ b/queue-5.4/kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch @@ -0,0 +1,130 @@ +From foo@baz Mon Aug 15 02:53:11 PM CEST 2022 +From: Stefan Ghinea +Date: Wed, 10 Aug 2022 23:25:50 +0300 +Subject: KVM: Add infrastructure and macro to mark VM as bugged +To: stable@vger.kernel.org +Cc: Sean Christopherson , Isaku Yamahata , Paolo Bonzini , Stefan Ghinea +Message-ID: <20220810202552.32242-1-stefan.ghinea@windriver.com> + +From: Sean Christopherson + +commit 0b8f11737cffc1a406d1134b58687abc29d76b52 upstream + +Signed-off-by: Sean Christopherson +Signed-off-by: Isaku Yamahata +Reviewed-by: Paolo Bonzini +Message-Id: <3a0998645c328bf0895f1290e61821b70f048549.1625186503.git.isaku.yamahata@intel.com> +Signed-off-by: Paolo Bonzini +[SG: Adjusted context for kernel version 5.4] +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/kvm_host.h | 28 +++++++++++++++++++++++++++- + virt/kvm/kvm_main.c | 10 +++++----- + 2 files changed, 32 insertions(+), 6 deletions(-) + +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -146,6 +146,7 @@ static inline bool is_error_page(struct + #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQ_PENDING_TIMER 2 + #define KVM_REQ_UNHALT 3 ++#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQUEST_ARCH_BASE 8 + + #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \ +@@ -502,6 +503,7 @@ struct kvm { + struct srcu_struct srcu; + struct srcu_struct irq_srcu; + pid_t userspace_pid; ++ bool vm_bugged; + }; + + #define kvm_err(fmt, ...) \ +@@ -530,6 +532,31 @@ struct kvm { + #define vcpu_err(vcpu, fmt, ...) \ + kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) + ++bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); ++static inline void kvm_vm_bugged(struct kvm *kvm) ++{ ++ kvm->vm_bugged = true; ++ kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED); ++} ++ ++#define KVM_BUG(cond, kvm, fmt...) \ ++({ \ ++ int __ret = (cond); \ ++ \ ++ if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \ ++ kvm_vm_bugged(kvm); \ ++ unlikely(__ret); \ ++}) ++ ++#define KVM_BUG_ON(cond, kvm) \ ++({ \ ++ int __ret = (cond); \ ++ \ ++ if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \ ++ kvm_vm_bugged(kvm); \ ++ unlikely(__ret); \ ++}) ++ + static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) + { + return srcu_dereference_check(kvm->buses[idx], &kvm->srcu, +@@ -790,7 +817,6 @@ void kvm_reload_remote_mmus(struct kvm * + + bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req, + unsigned long *vcpu_bitmap, cpumask_var_t tmp); +-bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); + + long kvm_arch_dev_ioctl(struct file *filp, + unsigned int ioctl, unsigned long arg); +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2937,7 +2937,7 @@ static long kvm_vcpu_ioctl(struct file * + struct kvm_fpu *fpu = NULL; + struct kvm_sregs *kvm_sregs = NULL; + +- if (vcpu->kvm->mm != current->mm) ++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) + return -EIO; + + if (unlikely(_IOC_TYPE(ioctl) != KVMIO)) +@@ -3144,7 +3144,7 @@ static long kvm_vcpu_compat_ioctl(struct + void __user *argp = compat_ptr(arg); + int r; + +- if (vcpu->kvm->mm != current->mm) ++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) + return -EIO; + + switch (ioctl) { +@@ -3209,7 +3209,7 @@ static long kvm_device_ioctl(struct file + { + struct kvm_device *dev = filp->private_data; + +- if (dev->kvm->mm != current->mm) ++ if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged) + return -EIO; + + switch (ioctl) { +@@ -3413,7 +3413,7 @@ static long kvm_vm_ioctl(struct file *fi + void __user *argp = (void __user *)arg; + int r; + +- if (kvm->mm != current->mm) ++ if (kvm->mm != current->mm || kvm->vm_bugged) + return -EIO; + switch (ioctl) { + case KVM_CREATE_VCPU: +@@ -3621,7 +3621,7 @@ static long kvm_vm_compat_ioctl(struct f + struct kvm *kvm = filp->private_data; + int r; + +- if (kvm->mm != current->mm) ++ if (kvm->mm != current->mm || kvm->vm_bugged) + return -EIO; + switch (ioctl) { + #ifdef CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT diff --git a/queue-5.4/kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch b/queue-5.4/kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch new file mode 100644 index 00000000000..b48ba18ec31 --- /dev/null +++ b/queue-5.4/kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch @@ -0,0 +1,39 @@ +From foo@baz Mon Aug 15 02:53:11 PM CEST 2022 +From: Stefan Ghinea +Date: Wed, 10 Aug 2022 23:25:52 +0300 +Subject: KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() +To: stable@vger.kernel.org +Cc: Vitaly Kuznetsov , Paolo Bonzini , Stefan Ghinea +Message-ID: <20220810202552.32242-3-stefan.ghinea@windriver.com> + +From: Vitaly Kuznetsov + +commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream + +When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF +shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON() +instead of crashing the host. + +Signed-off-by: Vitaly Kuznetsov +Message-Id: <20220325132140.25650-3-vkuznets@redhat.com> +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/lapic.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -955,6 +955,10 @@ bool kvm_irq_delivery_to_apic_fast(struc + *r = -1; + + if (irq->shorthand == APIC_DEST_SELF) { ++ if (KVM_BUG_ON(!src, kvm)) { ++ *r = 0; ++ return true; ++ } + *r = kvm_apic_set_irq(src->vcpu, irq, dest_map); + return true; + } diff --git a/queue-5.4/kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch b/queue-5.4/kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch new file mode 100644 index 00000000000..0880a23c308 --- /dev/null +++ b/queue-5.4/kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch @@ -0,0 +1,43 @@ +From foo@baz Mon Aug 15 02:53:11 PM CEST 2022 +From: Stefan Ghinea +Date: Wed, 10 Aug 2022 23:25:51 +0300 +Subject: KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq +To: stable@vger.kernel.org +Cc: Vitaly Kuznetsov , Paolo Bonzini , Stefan Ghinea +Message-ID: <20220810202552.32242-2-stefan.ghinea@windriver.com> + +From: Vitaly Kuznetsov + +commit 7ec37d1cbe17d8189d9562178d8b29167fe1c31a upstream + +When KVM_CAP_HYPERV_SYNIC{,2} is activated, KVM already checks for +irqchip_in_kernel() so normally SynIC irqs should never be set. It is, +however, possible for a misbehaving VMM to write to SYNIC/STIMER MSRs +causing erroneous behavior. + +The immediate issue being fixed is that kvm_irq_delivery_to_apic() +(kvm_irq_delivery_to_apic_fast()) crashes when called with +'irq.shorthand = APIC_DEST_SELF' and 'src == NULL'. + +Signed-off-by: Vitaly Kuznetsov +Message-Id: <20220325132140.25650-2-vkuznets@redhat.com> +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Stefan Ghinea +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/hyperv.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -309,6 +309,9 @@ static int synic_set_irq(struct kvm_vcpu + struct kvm_lapic_irq irq; + int ret, vector; + ++ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) ++ return -EINVAL; ++ + if (sint >= ARRAY_SIZE(synic->sint)) + return -EINVAL; + diff --git a/queue-5.4/series b/queue-5.4/series index 5baadc2d3ad..6063b5f99f3 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -280,3 +280,6 @@ iommu-vt-d-avoid-invalid-memory-access-via-node_online-numa_no_node.patch net_sched-cls_route-remove-from-list-when-handle-is-0.patch arm64-kexec_file-use-more-system-keyrings-to-verify-kernel-image-signature.patch btrfs-reject-log-replay-if-there-is-unsupported-ro-compat-flag.patch +kvm-add-infrastructure-and-macro-to-mark-vm-as-bugged.patch +kvm-x86-check-lapic_in_kernel-before-attempting-to-set-a-synic-irq.patch +kvm-x86-avoid-theoretical-null-pointer-dereference-in-kvm_irq_delivery_to_apic_fast.patch -- 2.47.3