kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (CVE-2016-9588)
This commit is contained in:
parent
e7ccf65ec6
commit
5efdda62b4
|
@ -10,6 +10,8 @@ linux (4.8.15-2) UNRELEASED; urgency=medium
|
||||||
[ Salvatore Bonaccorso ]
|
[ Salvatore Bonaccorso ]
|
||||||
* sg_write()/bsg_write() is not fit to be called under KERNEL_DS
|
* sg_write()/bsg_write() is not fit to be called under KERNEL_DS
|
||||||
(CVE-2016-10088)
|
(CVE-2016-10088)
|
||||||
|
* kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
|
||||||
|
(CVE-2016-9588)
|
||||||
|
|
||||||
-- Ben Hutchings <ben@decadent.org.uk> Tue, 27 Dec 2016 09:05:58 +0000
|
-- Ben Hutchings <ben@decadent.org.uk> Tue, 27 Dec 2016 09:05:58 +0000
|
||||||
|
|
||||||
|
|
65
debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch
vendored
Normal file
65
debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch
vendored
Normal file
|
@ -0,0 +1,65 @@
|
||||||
|
From: Jim Mattson <jmattson@google.com>
|
||||||
|
Date: Mon, 12 Dec 2016 11:01:37 -0800
|
||||||
|
Subject: kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
|
||||||
|
Origin: https://git.kernel.org/linus/ef85b67385436ddc1998f45f1d6a210f935b3388
|
||||||
|
|
||||||
|
When L2 exits to L0 due to "exception or NMI", software exceptions
|
||||||
|
(#BP and #OF) for which L1 has requested an intercept should be
|
||||||
|
handled by L1 rather than L0. Previously, only hardware exceptions
|
||||||
|
were forwarded to L1.
|
||||||
|
|
||||||
|
Signed-off-by: Jim Mattson <jmattson@google.com>
|
||||||
|
Cc: stable@vger.kernel.org
|
||||||
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||||
|
---
|
||||||
|
arch/x86/kvm/vmx.c | 11 +++++------
|
||||||
|
1 file changed, 5 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
|
||||||
|
index c41d7ffdda5a..24db5fb6f575 100644
|
||||||
|
--- a/arch/x86/kvm/vmx.c
|
||||||
|
+++ b/arch/x86/kvm/vmx.c
|
||||||
|
@@ -1389,10 +1389,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
|
||||||
|
return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static inline bool is_exception(u32 intr_info)
|
||||||
|
+static inline bool is_nmi(u32 intr_info)
|
||||||
|
{
|
||||||
|
return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
|
||||||
|
- == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
|
||||||
|
+ == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
|
||||||
|
}
|
||||||
|
|
||||||
|
static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
|
||||||
|
@@ -5728,7 +5728,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
|
||||||
|
if (is_machine_check(intr_info))
|
||||||
|
return handle_machine_check(vcpu);
|
||||||
|
|
||||||
|
- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
|
||||||
|
+ if (is_nmi(intr_info))
|
||||||
|
return 1; /* already handled by vmx_vcpu_run() */
|
||||||
|
|
||||||
|
if (is_no_device(intr_info)) {
|
||||||
|
@@ -8170,7 +8170,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
|
||||||
|
|
||||||
|
switch (exit_reason) {
|
||||||
|
case EXIT_REASON_EXCEPTION_NMI:
|
||||||
|
- if (!is_exception(intr_info))
|
||||||
|
+ if (is_nmi(intr_info))
|
||||||
|
return false;
|
||||||
|
else if (is_page_fault(intr_info))
|
||||||
|
return enable_ept;
|
||||||
|
@@ -8765,8 +8765,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
|
||||||
|
kvm_machine_check();
|
||||||
|
|
||||||
|
/* We need to handle NMIs before interrupts are enabled */
|
||||||
|
- if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
|
||||||
|
- (exit_intr_info & INTR_INFO_VALID_MASK)) {
|
||||||
|
+ if (is_nmi(exit_intr_info)) {
|
||||||
|
kvm_before_handle_nmi(&vmx->vcpu);
|
||||||
|
asm("int $2");
|
||||||
|
kvm_after_handle_nmi(&vmx->vcpu);
|
||||||
|
--
|
||||||
|
2.11.0
|
||||||
|
|
|
@ -105,6 +105,7 @@ bugfix/all/mnt-Add-a-per-mount-namespace-limit-on-the-number-of.patch
|
||||||
bugfix/all/net-handle-no-dst-on-skb-in-icmp6_send.patch
|
bugfix/all/net-handle-no-dst-on-skb-in-icmp6_send.patch
|
||||||
bugfix/all/netfilter-ipv6-nf_defrag-drop-mangled-skb-on-ream-er.patch
|
bugfix/all/netfilter-ipv6-nf_defrag-drop-mangled-skb-on-ream-er.patch
|
||||||
bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-KER.patch
|
bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-KER.patch
|
||||||
|
bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch
|
||||||
|
|
||||||
# ABI maintenance
|
# ABI maintenance
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue