From 5efdda62b441b731a698bca07bfcdac8392369a1 Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Sun, 1 Jan 2017 09:12:12 +0100 Subject: [PATCH] kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (CVE-2016-9588) --- debian/changelog | 2 + ...1-to-intercept-software-exceptions-B.patch | 65 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 68 insertions(+) create mode 100644 debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch diff --git a/debian/changelog b/debian/changelog index 92d3c4d79..1b985b785 100644 --- a/debian/changelog +++ b/debian/changelog @@ -10,6 +10,8 @@ linux (4.8.15-2) UNRELEASED; urgency=medium [ Salvatore Bonaccorso ] * sg_write()/bsg_write() is not fit to be called under KERNEL_DS (CVE-2016-10088) + * kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) + (CVE-2016-9588) -- Ben Hutchings Tue, 27 Dec 2016 09:05:58 +0000 diff --git a/debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch b/debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch new file mode 100644 index 000000000..906a67cfd --- /dev/null +++ b/debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch @@ -0,0 +1,65 @@ +From: Jim Mattson +Date: Mon, 12 Dec 2016 11:01:37 -0800 +Subject: kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) +Origin: https://git.kernel.org/linus/ef85b67385436ddc1998f45f1d6a210f935b3388 + +When L2 exits to L0 due to "exception or NMI", software exceptions +(#BP and #OF) for which L1 has requested an intercept should be +handled by L1 rather than L0. Previously, only hardware exceptions +were forwarded to L1. + +Signed-off-by: Jim Mattson +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +--- + arch/x86/kvm/vmx.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index c41d7ffdda5a..24db5fb6f575 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1389,10 +1389,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12) + return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR; + } + +-static inline bool is_exception(u32 intr_info) ++static inline bool is_nmi(u32 intr_info) + { + return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK)) +- == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK); ++ == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK); + } + + static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, +@@ -5728,7 +5728,7 @@ static int handle_exception(struct kvm_vcpu *vcpu) + if (is_machine_check(intr_info)) + return handle_machine_check(vcpu); + +- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR) ++ if (is_nmi(intr_info)) + return 1; /* already handled by vmx_vcpu_run() */ + + if (is_no_device(intr_info)) { +@@ -8170,7 +8170,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) + + switch (exit_reason) { + case EXIT_REASON_EXCEPTION_NMI: +- if (!is_exception(intr_info)) ++ if (is_nmi(intr_info)) + return false; + else if (is_page_fault(intr_info)) + return enable_ept; +@@ -8765,8 +8765,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx) + kvm_machine_check(); + + /* We need to handle NMIs before interrupts are enabled */ +- if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR && +- (exit_intr_info & INTR_INFO_VALID_MASK)) { ++ if (is_nmi(exit_intr_info)) { + kvm_before_handle_nmi(&vmx->vcpu); + asm("int $2"); + kvm_after_handle_nmi(&vmx->vcpu); +-- +2.11.0 + diff --git a/debian/patches/series b/debian/patches/series index a01874737..c7ac9b370 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -105,6 +105,7 @@ bugfix/all/mnt-Add-a-per-mount-namespace-limit-on-the-number-of.patch bugfix/all/net-handle-no-dst-on-skb-in-icmp6_send.patch bugfix/all/netfilter-ipv6-nf_defrag-drop-mangled-skb-on-ream-er.patch bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-KER.patch +bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch # ABI maintenance