patches/kernel/0008-UBUNTU-SAUCE-KVM-nSVM-avoid-picking-up-unsupported-b.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Maxim Levitsky <mlevitsk@redhat.com>
   3 Date: Thu, 29 Jul 2021 17:54:04 +0300
   4 Subject: [PATCH] UBUNTU: SAUCE: KVM: nSVM: avoid picking up unsupported bits
   5  from L2 in int_ctl
   6
   7 This fixes CVE-2021-3653 that allowed a malicious L1 to run L2 with
   8 AVIC enabled, which allowed the L2 to exploit the uninitialized and enabled
   9 AVIC to read/write the host physical memory at some offsets.
  10
  11 The bug was discovered by Maxim Levitsky.
  12
  13 Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler")
  14 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
  15 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  16 CVE-2021-3653
  17 Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
  18 Acked-by: Stefan Bader <stefan.bader@canonical.com>
  19 Acked-by: Ben Romer <benjamin.romer@canonical.com>
  20 Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
  21 (cherry picked from commit d4c8d125f361e6aef5d58490672f7efa83dab257)
  22 Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
  23 ---
  24  arch/x86/include/asm/svm.h |  2 ++
  25  arch/x86/kvm/svm/nested.c  | 11 +++++++----
  26  arch/x86/kvm/svm/svm.c     |  8 ++++----
  27  3 files changed, 13 insertions(+), 8 deletions(-)
  28
  29 diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h
  30 index 1c561945b426..6278111bbf97 100644
  31 --- a/arch/x86/include/asm/svm.h
  32 +++ b/arch/x86/include/asm/svm.h
  33 @@ -178,6 +178,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area {
  34  #define V_IGN_TPR_SHIFT 20
  35  #define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT)
  36
  37 +#define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_TPR_MASK)
  38 +
  39  #define V_INTR_MASKING_SHIFT 24
  40  #define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT)
  41
  42 diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
  43 index 0b3bf6e2aeb9..049d3cbbee5a 100644
  44 --- a/arch/x86/kvm/svm/nested.c
  45 +++ b/arch/x86/kvm/svm/nested.c
  46 @@ -429,7 +429,10 @@ static void nested_prepare_vmcb_save(struct vcpu_svm *svm, struct vmcb *vmcb12)
  47
  48  static void nested_prepare_vmcb_control(struct vcpu_svm *svm)
  49  {
  50 -       const u32 mask = V_INTR_MASKING_MASK | V_GIF_ENABLE_MASK | V_GIF_MASK;
  51 +       const u32 int_ctl_vmcb01_bits =
  52 +               V_INTR_MASKING_MASK | V_GIF_MASK | V_GIF_ENABLE_MASK;
  53 +
  54 +       const u32 int_ctl_vmcb12_bits = V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK;
  55
  56         if (nested_npt_enabled(svm))
  57                 nested_svm_init_mmu_context(&svm->vcpu);
  58 @@ -437,9 +440,9 @@ static void nested_prepare_vmcb_control(struct vcpu_svm *svm)
  59         svm->vmcb->control.tsc_offset = svm->vcpu.arch.tsc_offset =
  60                 svm->vcpu.arch.l1_tsc_offset + svm->nested.ctl.tsc_offset;
  61
  62 -       svm->vmcb->control.int_ctl             =
  63 -               (svm->nested.ctl.int_ctl & ~mask) |
  64 -               (svm->nested.hsave->control.int_ctl & mask);
  65 +       svm->vmcb->control.int_ctl =
  66 +               (svm->nested.ctl.int_ctl & int_ctl_vmcb12_bits) |
  67 +               (svm->nested.hsave->control.int_ctl & int_ctl_vmcb01_bits);
  68
  69         svm->vmcb->control.virt_ext            = svm->nested.ctl.virt_ext;
  70         svm->vmcb->control.int_vector          = svm->nested.ctl.int_vector;
  71 diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
  72 index 786c0eb8bd29..b676386f877e 100644
  73 --- a/arch/x86/kvm/svm/svm.c
  74 +++ b/arch/x86/kvm/svm/svm.c
  75 @@ -1547,17 +1547,17 @@ static void svm_set_vintr(struct vcpu_svm *svm)
  76
  77  static void svm_clear_vintr(struct vcpu_svm *svm)
  78  {
  79 -       const u32 mask = V_TPR_MASK | V_GIF_ENABLE_MASK | V_GIF_MASK | V_INTR_MASKING_MASK;
  80         svm_clr_intercept(svm, INTERCEPT_VINTR);
  81
  82         /* Drop int_ctl fields related to VINTR injection.  */
  83 -       svm->vmcb->control.int_ctl &= mask;
  84 +       svm->vmcb->control.int_ctl &= ~V_IRQ_INJECTION_BITS_MASK;
  85         if (is_guest_mode(&svm->vcpu)) {
  86 -               svm->nested.hsave->control.int_ctl &= mask;
  87 +               svm->nested.hsave->control.int_ctl &= ~V_IRQ_INJECTION_BITS_MASK;
  88
  89                 WARN_ON((svm->vmcb->control.int_ctl & V_TPR_MASK) !=
  90                         (svm->nested.ctl.int_ctl & V_TPR_MASK));
  91 -               svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl & ~mask;
  92 +               svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl &
  93 +                       V_IRQ_INJECTION_BITS_MASK;
  94         }
  95
  96         vmcb_mark_dirty(svm->vmcb, VMCB_INTR);