|
 |
20c5052 |
Bugzilla: 1042099
|
|
|
20c5052 |
Upstream-status: 3.13 and sent for stable
|
|
|
20c5052 |
Delivered-To: jwboyer@gmail.com
|
|
|
20c5052 |
Received: by 10.76.104.107 with SMTP id gd11csp361370oab;
|
|
|
20c5052 |
Thu, 12 Dec 2013 12:42:56 -0800 (PST)
|
|
|
20c5052 |
X-Received: by 10.43.172.4 with SMTP id nw4mr8453091icc.25.1386880976232;
|
|
|
20c5052 |
Thu, 12 Dec 2013 12:42:56 -0800 (PST)
|
|
|
20c5052 |
Return-Path: <stable-owner@vger.kernel.org>
|
|
|
20c5052 |
Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
|
|
|
20c5052 |
by mx.google.com with ESMTP id 2si15667240pax.109.2013.12.12.12.42.31
|
|
|
20c5052 |
for <multiple recipients>;
|
|
|
20c5052 |
Thu, 12 Dec 2013 12:42:56 -0800 (PST)
|
|
|
20c5052 |
Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
|
|
|
20c5052 |
Authentication-Results: mx.google.com;
|
|
|
20c5052 |
spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mail=stable-owner@vger.kernel.org;
|
|
|
20c5052 |
dkim=neutral (bad format) header.i=@gmail.com
|
|
|
20c5052 |
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
|
|
|
20c5052 |
id S1751853Ab3LLUiJ (ORCPT <rfc822;kumadasu@gmail.com> + 64 others);
|
|
|
20c5052 |
Thu, 12 Dec 2013 15:38:09 -0500
|
|
|
20c5052 |
Received: from mail-ee0-f54.google.com ([74.125.83.54]:48290 "EHLO
|
|
|
20c5052 |
mail-ee0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
|
|
|
20c5052 |
with ESMTP id S1751884Ab3LLUhS (ORCPT
|
|
|
20c5052 |
<rfc822;stable@vger.kernel.org>); Thu, 12 Dec 2013 15:37:18 -0500
|
|
|
20c5052 |
Received: by mail-ee0-f54.google.com with SMTP id e51so406857eek.13
|
|
|
20c5052 |
for <multiple recipients>; Thu, 12 Dec 2013 12:37:17 -0800 (PST)
|
|
|
20c5052 |
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
|
|
|
20c5052 |
d=gmail.com; s=20120113;
|
|
|
20c5052 |
h=sender:from:to:cc:subject:date:message-id;
|
|
|
20c5052 |
bh=VG00enyRpNYeJLwAwqWOGuy3mCBmvpmEBgLPB1IiKNo=;
|
|
|
20c5052 |
b=p0BlraPBMTIxTXGUuJyYTYRxuMKATenNpVX01fyzNpSYZsMruyMU/sJ8gdc2991eao
|
|
|
20c5052 |
ZU+66Xlnbd+AyQiuq4P9sMv6Gvax6MvJg04SMZWnLWoZGonmIIwSPch1UKLSJzRN7K+N
|
|
|
20c5052 |
+Ot3jLtNBYBoREljPkbscbMVOJ2y+S7N61oOZ7IHZNyXVFWDlW8aunduSgc3cytBEhkx
|
|
|
20c5052 |
UMUUbHVLo+XrXtuggFrmn8oUfJ1hiHQSpOyx8bi0ztxlEjL4DEFpJsKbjRe4sGRgeUy6
|
|
|
20c5052 |
dRk+7dEcILKBTRVvXaJSriXG5bhZTbcZ5gZab27Ilm1H8Va5Z6R+9C1AwX2x5CQA7Mb1
|
|
|
20c5052 |
Edug==
|
|
|
20c5052 |
X-Received: by 10.14.107.3 with SMTP id n3mr9951281eeg.67.1386880636981;
|
|
|
20c5052 |
Thu, 12 Dec 2013 12:37:16 -0800 (PST)
|
|
|
20c5052 |
Received: from playground.com (net-2-35-202-54.cust.dsl.vodafone.it. [2.35.202.54])
|
|
|
20c5052 |
by mx.google.com with ESMTPSA id o47sm70323739eem.21.2013.12.12.12.37.15
|
|
|
20c5052 |
for <multiple recipients>
|
|
|
20c5052 |
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
|
|
|
20c5052 |
Thu, 12 Dec 2013 12:37:16 -0800 (PST)
|
|
|
20c5052 |
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
20c5052 |
To: linux-kernel@vger.kernel.org
|
|
|
20c5052 |
Cc: gleb@redhat.com, kvm@vger.kernel.org, pmatouse@redhat.com,
|
|
|
20c5052 |
stable@vger.kernel.org
|
|
|
20c5052 |
Subject: [PATCH] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)
|
|
|
20c5052 |
Date: Thu, 12 Dec 2013 21:36:54 +0100
|
|
|
20c5052 |
Message-Id: <1386880614-23300-4-git-send-email-pbonzini@redhat.com>
|
|
|
20c5052 |
X-Mailer: git-send-email 1.8.3.1
|
|
|
20c5052 |
Sender: stable-owner@vger.kernel.org
|
|
|
20c5052 |
Precedence: bulk
|
|
|
20c5052 |
List-ID: <stable.vger.kernel.org>
|
|
|
20c5052 |
X-Mailing-List: stable@vger.kernel.org
|
|
|
20c5052 |
|
|
|
20c5052 |
From: Gleb Natapov <gleb@redhat.com>
|
|
|
20c5052 |
|
|
|
20c5052 |
A guest can cause a BUG_ON() leading to a host kernel crash.
|
|
|
20c5052 |
When the guest writes to the ICR to request an IPI, while in x2apic
|
|
|
20c5052 |
mode the following things happen, the destination is read from
|
|
|
20c5052 |
ICR2, which is a register that the guest can control.
|
|
|
20c5052 |
|
|
|
20c5052 |
kvm_irq_delivery_to_apic_fast uses the high 16 bits of ICR2 as the
|
|
|
20c5052 |
cluster id. A BUG_ON is triggered, which is a protection against
|
|
|
20c5052 |
accessing map->logical_map with an out-of-bounds access and manages
|
|
|
20c5052 |
to avoid that anything really unsafe occurs.
|
|
|
20c5052 |
|
|
|
20c5052 |
The logic in the code is correct from real HW point of view. The problem
|
|
|
20c5052 |
is that KVM supports only one cluster with ID 0 in clustered mode, but
|
|
|
20c5052 |
the code that has the bug does not take this into account.
|
|
|
20c5052 |
|
|
|
20c5052 |
Reported-by: Lars Bull <larsbull@google.com>
|
|
|
20c5052 |
Cc: stable@vger.kernel.org
|
|
|
20c5052 |
Signed-off-by: Gleb Natapov <gleb@redhat.com>
|
|
|
20c5052 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
20c5052 |
---
|
|
|
20c5052 |
arch/x86/kvm/lapic.c | 5 ++++-
|
|
|
20c5052 |
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
20c5052 |
|
|
|
20c5052 |
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
|
|
|
20c5052 |
index b8bec45c1610..801dc3fd66e1 100644
|
|
|
20c5052 |
--- a/arch/x86/kvm/lapic.c
|
|
|
20c5052 |
+++ b/arch/x86/kvm/lapic.c
|
|
|
20c5052 |
@@ -143,6 +143,8 @@ static inline int kvm_apic_id(struct kvm_lapic *apic)
|
|
|
20c5052 |
return (kvm_apic_get_reg(apic, APIC_ID) >> 24) & 0xff;
|
|
|
20c5052 |
}
|
|
|
20c5052 |
|
|
|
20c5052 |
+#define KMV_X2APIC_CID_BITS 0
|
|
|
20c5052 |
+
|
|
|
20c5052 |
static void recalculate_apic_map(struct kvm *kvm)
|
|
|
20c5052 |
{
|
|
|
20c5052 |
struct kvm_apic_map *new, *old = NULL;
|
|
|
20c5052 |
@@ -180,7 +182,8 @@ static void recalculate_apic_map(struct kvm *kvm)
|
|
|
20c5052 |
if (apic_x2apic_mode(apic)) {
|
|
|
20c5052 |
new->ldr_bits = 32;
|
|
|
20c5052 |
new->cid_shift = 16;
|
|
|
20c5052 |
- new->cid_mask = new->lid_mask = 0xffff;
|
|
|
20c5052 |
+ new->cid_mask = (1 << KMV_X2APIC_CID_BITS) - 1;
|
|
|
20c5052 |
+ new->lid_mask = 0xffff;
|
|
|
20c5052 |
} else if (kvm_apic_sw_enabled(apic) &&
|
|
|
20c5052 |
!new->cid_mask /* flat mode */ &&
|
|
|
20c5052 |
kvm_apic_get_reg(apic, APIC_DFR) == APIC_DFR_CLUSTER) {
|
|
|
20c5052 |
--
|
|
|
20c5052 |
1.8.3.1
|
|
|
20c5052 |
|
|
|
20c5052 |
--
|
|
|
20c5052 |
To unsubscribe from this list: send the line "unsubscribe stable" in
|
|
|
20c5052 |
the body of a message to majordomo@vger.kernel.org
|
|
|
20c5052 |
More majordomo info at http://vger.kernel.org/majordomo-info.html
|