--- /dev/null
+From foo@baz Mon Aug 15 02:53:54 PM CEST 2022
+From: Stefan Ghinea <stefan.ghinea@windriver.com>
+Date: Wed, 10 Aug 2022 23:26:22 +0300
+Subject: KVM: Add infrastructure and macro to mark VM as bugged
+To: stable@vger.kernel.org
+Cc: Sean Christopherson <sean.j.christopherson@intel.com>, Isaku Yamahata <isaku.yamahata@intel.com>, Paolo Bonzini <pbonzini@redhat.com>, Stefan Ghinea <stefan.ghinea@windriver.com>
+Message-ID: <20220810202625.32529-1-stefan.ghinea@windriver.com>
+
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+
+commit 0b8f11737cffc1a406d1134b58687abc29d76b52 upstream
+
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-Id: <3a0998645c328bf0895f1290e61821b70f048549.1625186503.git.isaku.yamahata@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[SG: Adjusted context for kernel version 4.19]
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/kvm_host.h | 28 +++++++++++++++++++++++++++-
+ virt/kvm/kvm_main.c | 10 +++++-----
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -128,6 +128,7 @@ static inline bool is_error_page(struct
+ #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
+ #define KVM_REQ_PENDING_TIMER 2
+ #define KVM_REQ_UNHALT 3
++#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)
+ #define KVM_REQUEST_ARCH_BASE 8
+
+ #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \
+@@ -482,6 +483,7 @@ struct kvm {
+ struct srcu_struct srcu;
+ struct srcu_struct irq_srcu;
+ pid_t userspace_pid;
++ bool vm_bugged;
+ };
+
+ #define kvm_err(fmt, ...) \
+@@ -510,6 +512,31 @@ struct kvm {
+ #define vcpu_err(vcpu, fmt, ...) \
+ kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__)
+
++bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req);
++static inline void kvm_vm_bugged(struct kvm *kvm)
++{
++ kvm->vm_bugged = true;
++ kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED);
++}
++
++#define KVM_BUG(cond, kvm, fmt...) \
++({ \
++ int __ret = (cond); \
++ \
++ if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \
++ kvm_vm_bugged(kvm); \
++ unlikely(__ret); \
++})
++
++#define KVM_BUG_ON(cond, kvm) \
++({ \
++ int __ret = (cond); \
++ \
++ if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \
++ kvm_vm_bugged(kvm); \
++ unlikely(__ret); \
++})
++
+ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx)
+ {
+ return srcu_dereference_check(kvm->buses[idx], &kvm->srcu,
+@@ -770,7 +797,6 @@ void kvm_reload_remote_mmus(struct kvm *
+
+ bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req,
+ unsigned long *vcpu_bitmap, cpumask_var_t tmp);
+-bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req);
+
+ long kvm_arch_dev_ioctl(struct file *filp,
+ unsigned int ioctl, unsigned long arg);
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2820,7 +2820,7 @@ static long kvm_vcpu_ioctl(struct file *
+ struct kvm_fpu *fpu = NULL;
+ struct kvm_sregs *kvm_sregs = NULL;
+
+- if (vcpu->kvm->mm != current->mm)
++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged)
+ return -EIO;
+
+ if (unlikely(_IOC_TYPE(ioctl) != KVMIO))
+@@ -3026,7 +3026,7 @@ static long kvm_vcpu_compat_ioctl(struct
+ void __user *argp = compat_ptr(arg);
+ int r;
+
+- if (vcpu->kvm->mm != current->mm)
++ if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged)
+ return -EIO;
+
+ switch (ioctl) {
+@@ -3081,7 +3081,7 @@ static long kvm_device_ioctl(struct file
+ {
+ struct kvm_device *dev = filp->private_data;
+
+- if (dev->kvm->mm != current->mm)
++ if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged)
+ return -EIO;
+
+ switch (ioctl) {
+@@ -3244,7 +3244,7 @@ static long kvm_vm_ioctl(struct file *fi
+ void __user *argp = (void __user *)arg;
+ int r;
+
+- if (kvm->mm != current->mm)
++ if (kvm->mm != current->mm || kvm->vm_bugged)
+ return -EIO;
+ switch (ioctl) {
+ case KVM_CREATE_VCPU:
+@@ -3422,7 +3422,7 @@ static long kvm_vm_compat_ioctl(struct f
+ struct kvm *kvm = filp->private_data;
+ int r;
+
+- if (kvm->mm != current->mm)
++ if (kvm->mm != current->mm || kvm->vm_bugged)
+ return -EIO;
+ switch (ioctl) {
+ case KVM_GET_DIRTY_LOG: {
--- /dev/null
+From foo@baz Mon Aug 15 02:53:54 PM CEST 2022
+From: Stefan Ghinea <stefan.ghinea@windriver.com>
+Date: Wed, 10 Aug 2022 23:26:24 +0300
+Subject: KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
+To: stable@vger.kernel.org
+Cc: Vitaly Kuznetsov <vkuznets@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Stefan Ghinea <stefan.ghinea@windriver.com>
+Message-ID: <20220810202625.32529-3-stefan.ghinea@windriver.com>
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream
+
+When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF
+shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON()
+instead of crashing the host.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Message-Id: <20220325132140.25650-3-vkuznets@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/lapic.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -961,6 +961,10 @@ bool kvm_irq_delivery_to_apic_fast(struc
+ *r = -1;
+
+ if (irq->shorthand == APIC_DEST_SELF) {
++ if (KVM_BUG_ON(!src, kvm)) {
++ *r = 0;
++ return true;
++ }
+ *r = kvm_apic_set_irq(src->vcpu, irq, dest_map);
+ return true;
+ }
--- /dev/null
+From foo@baz Mon Aug 15 02:53:54 PM CEST 2022
+From: Stefan Ghinea <stefan.ghinea@windriver.com>
+Date: Wed, 10 Aug 2022 23:26:23 +0300
+Subject: KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
+To: stable@vger.kernel.org
+Cc: Vitaly Kuznetsov <vkuznets@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, Stefan Ghinea <stefan.ghinea@windriver.com>
+Message-ID: <20220810202625.32529-2-stefan.ghinea@windriver.com>
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit 7ec37d1cbe17d8189d9562178d8b29167fe1c31a upstream
+
+When KVM_CAP_HYPERV_SYNIC{,2} is activated, KVM already checks for
+irqchip_in_kernel() so normally SynIC irqs should never be set. It is,
+however, possible for a misbehaving VMM to write to SYNIC/STIMER MSRs
+causing erroneous behavior.
+
+The immediate issue being fixed is that kvm_irq_delivery_to_apic()
+(kvm_irq_delivery_to_apic_fast()) crashes when called with
+'irq.shorthand = APIC_DEST_SELF' and 'src == NULL'.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Message-Id: <20220325132140.25650-2-vkuznets@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/hyperv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -341,6 +341,9 @@ static int synic_set_irq(struct kvm_vcpu
+ struct kvm_lapic_irq irq;
+ int ret, vector;
+
++ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm))
++ return -EINVAL;
++
+ if (sint >= ARRAY_SIZE(synic->sint))
+ return -EINVAL;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
