patches/kernel-cves/CVE-2017-12188_0002-KVM-MMU-always-terminate-page-walks-at-level-1.patch

   1 From ebe182a7c6221878cbb5d03e1eafa8002494f8cb Mon Sep 17 00:00:00 2001
   2 From: Ladi Prosek <lprosek@redhat.com>
   3 Date: Tue, 10 Oct 2017 17:30:59 +0200
   4 Subject: [CVE-2017-12188 2/2] KVM: MMU: always terminate page walks at level 1
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 is_last_gpte() is not equivalent to the pseudo-code given in commit
  10 6bb69c9b69c31 ("KVM: MMU: simplify last_pte_bitmap") because an incorrect
  11 value of last_nonleaf_level may override the result even if level == 1.
  12
  13 It is critical for is_last_gpte() to return true on level == 1 to
  14 terminate page walks. Otherwise memory corruption may occur as level
  15 is used as an index to various data structures throughout the page
  16 walking code.  Even though the actual bug would be wherever the MMU is
  17 initialized (as in the previous patch), be defensive and ensure here
  18 that is_last_gpte() returns the correct value.
  19
  20 This patch is also enough to fix CVE-2017-12188, and suggested for
  21 stable and distro kernels.
  22
  23 Fixes: 6bb69c9b69c315200ddc2bc79aee14c0184cf5b2
  24 Cc: stable@vger.kernel.org
  25 Cc: Andy Honig <ahonig@google.com>
  26 Signed-off-by: Ladi Prosek <lprosek@redhat.com>
  27 [Panic if walk_addr_generic gets an incorrect level; this is a serious
  28  bug and it's not worth a WARN_ON where the recovery path might hide
  29  further exploitable issues; suggested by Andrew Honig. - Paolo]
  30 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  31 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  32 ---
  33  arch/x86/kvm/paging_tmpl.h |  3 ++-
  34  arch/x86/kvm/mmu.c         | 14 +++++++-------
  35  2 files changed, 9 insertions(+), 8 deletions(-)
  36
  37 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
  38 index b0454c7e4cff..da06dc8c4fc4 100644
  39 --- a/arch/x86/kvm/paging_tmpl.h
  40 +++ b/arch/x86/kvm/paging_tmpl.h
  41 @@ -334,10 +334,11 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
  42                 --walker->level;
  43
  44                 index = PT_INDEX(addr, walker->level);
  45 -
  46                 table_gfn = gpte_to_gfn(pte);
  47                 offset    = index * sizeof(pt_element_t);
  48                 pte_gpa   = gfn_to_gpa(table_gfn) + offset;
  49 +
  50 +               BUG_ON(walker->level < 1);
  51                 walker->table_gfn[walker->level - 1] = table_gfn;
  52                 walker->pte_gpa[walker->level - 1] = pte_gpa;
  53
  54 diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
  55 index ca0112742343..2e4a6732aaa9 100644
  56 --- a/arch/x86/kvm/mmu.c
  57 +++ b/arch/x86/kvm/mmu.c
  58 @@ -3934,13 +3934,6 @@ static bool sync_mmio_spte(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn,
  59  static inline bool is_last_gpte(struct kvm_mmu *mmu,
  60                                 unsigned level, unsigned gpte)
  61  {
  62 -       /*
  63 -        * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
  64 -        * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
  65 -        * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
  66 -        */
  67 -       gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
  68 -
  69         /*
  70          * The RHS has bit 7 set iff level < mmu->last_nonleaf_level.
  71          * If it is clear, there are no large pages at this level, so clear
  72 @@ -3948,6 +3941,13 @@ static inline bool is_last_gpte(struct kvm_mmu *mmu,
  73          */
  74         gpte &= level - mmu->last_nonleaf_level;
  75
  76 +       /*
  77 +        * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
  78 +        * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
  79 +        * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
  80 +        */
  81 +       gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
  82 +
  83         return gpte & PT_PAGE_SIZE_MASK;
  84  }
  85
  86 --
  87 2.14.1
  88