From 92f972094e052a8bda7912e047aab48e57de9eda Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Thu, 14 Apr 2016 20:51:37 +0200 Subject: [PATCH] [x86] xen: suppress hugetlbfs in PV guests (CVE-2016-3961) --- debian/changelog | 7 ++ ...-xen-suppress-hugetlbfs-in-PV-guests.patch | 73 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 81 insertions(+) create mode 100644 debian/patches/bugfix/x86/x86-xen-suppress-hugetlbfs-in-PV-guests.patch diff --git a/debian/changelog b/debian/changelog index a5515a212..cdacc3a37 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +linux (4.5.1-2) UNRELEASED; urgency=medium + + [ Salvatore Bonaccorso ] + * [x86] xen: suppress hugetlbfs in PV guests (CVE-2016-3961) + + -- Salvatore Bonaccorso Thu, 14 Apr 2016 20:52:28 +0200 + linux (4.5.1-1) unstable; urgency=medium * New upstream stable update: diff --git a/debian/patches/bugfix/x86/x86-xen-suppress-hugetlbfs-in-PV-guests.patch b/debian/patches/bugfix/x86/x86-xen-suppress-hugetlbfs-in-PV-guests.patch new file mode 100644 index 000000000..4fe6018f4 --- /dev/null +++ b/debian/patches/bugfix/x86/x86-xen-suppress-hugetlbfs-in-PV-guests.patch @@ -0,0 +1,73 @@ +From: Jan Beulich +Date: Thu, 14 Apr 2016 20:38:30 +0200 +Subject: x86/xen: suppress hugetlbfs in PV guests +Origin: http://xenbits.xen.org/xsa/xsa174.patch + +Huge pages are not normally available to PV guests. Not suppressing +hugetlbfs use results in an endless loop of page faults when user mode +code tries to access a hugetlbfs mapped area (since the hypervisor +denies such PTEs to be created, but error indications can't be +propagated out of xen_set_pte_at(), just like for various of its +siblings), and - once killed in an oops like this: + +kernel BUG at .../fs/hugetlbfs/inode.c:428! +invalid opcode: 0000 [#1] SMP +Modules linked in: ... +Supported: Yes +CPU: 2 PID: 6088 Comm: hugetlbfs Tainted: G W 4.4.0-2016-01-20-pv #2 +Hardware name: ... +task: ffff8808059205c0 ti: ffff880803c84000 task.ti: ffff880803c84000 +RIP: e030:[] [] remove_inode_hugepages+0x25b/0x320 +RSP: e02b:ffff880803c879a8 EFLAGS: 00010202 +RAX: 000000000077a4db RBX: ffffea001acff000 RCX: 0000000078417d38 +RDX: 0000000000000000 RSI: 000000007e154fa7 RDI: ffff880805d70960 +RBP: 0000000000000960 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 +R13: ffff880807486018 R14: 0000000000000000 R15: ffff880803c87af0 +FS: 00007f85fa8b8700(0000) GS:ffff88080b640000(0000) knlGS:0000000000000000 +CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b +CR2: 00007f85fa000000 CR3: 0000000001a0a000 CR4: 0000000000040660 +Stack: + ffff880000000fb0 ffff880803c87a18 ffff880803c87ae8 ffff8808059205c0 + ffff880803c87af0 ffff880803c87ae8 ffff880807486018 0000000000000000 + ffffffff81bf6e60 ffff880807486168 000003ffffffffff 0000000003c87758 +Call Trace: + [] hugetlbfs_evict_inode+0x15/0x40 + [] evict+0xbd/0x1b0 + [] __dentry_kill+0x19a/0x1f0 + [] dput+0x1fe/0x220 + [] __fput+0x155/0x200 + [] task_work_run+0x60/0xa0 + [] do_exit+0x160/0x400 + [] do_group_exit+0x3b/0xa0 + [] get_signal+0x1ed/0x470 + [] do_signal+0x14/0x110 + [] prepare_exit_to_usermode+0xe9/0xf0 + [] retint_user+0x8/0x13 + +This is XSA-174. + +Reported-by: Vitaly Kuznetsov +Signed-off-by: Jan Beulich +Cc: stable@vger.kernel.org +--- +v2: Make Xen-inspecific, by using cpu_has_pse. +--- + arch/x86/include/asm/hugetlb.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h +index f8a29d2..e6a8613 100644 +--- a/arch/x86/include/asm/hugetlb.h ++++ b/arch/x86/include/asm/hugetlb.h +@@ -4,6 +4,7 @@ + #include + #include + ++#define hugepages_supported() cpu_has_pse + + static inline int is_hugepage_only_range(struct mm_struct *mm, + unsigned long addr, +-- +2.8.0.rc3 + diff --git a/debian/patches/series b/debian/patches/series index 409be86a1..719f1b984 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -123,6 +123,7 @@ bugfix/all/netfilter-x_tables-validate-e-target_offset-early.patch bugfix/all/netfilter-x_tables-make-sure-e-next_offset-covers-re.patch bugfix/all/ipv4-don-t-do-expensive-useless-work-during-inetdev-.patch bugfix/x86/x86-mm-32-enable-full-randomization-on-i386-and-x86_.patch +bugfix/x86/x86-xen-suppress-hugetlbfs-in-PV-guests.patch # Tools bug fixes bugfix/all/usbip-document-tcp-wrappers.patch