The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.
Possible dependencies:
16ae56d7e052 ("KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in use") 2fcf4876ada8 ("KVM: nSVM: implement on demand allocation of the nested state") 72f211ecaa80 ("KVM: x86: allow kvm_x86_ops.set_efer to return an error value") fd6fa73d1337 ("KVM: x86: SVM: Prevent MSR passthrough when MSR access is denied") 476c9bd8e997 ("KVM: x86: Prepare MSR bitmaps for userspace tracked MSRs") d85a8034c016 ("KVM: VMX: Rename "find_msr_entry" to "vmx_find_uret_msr"") eb3db1b13788 ("KVM: VMX: Rename the "shared_msr_entry" struct to "vmx_uret_msr"") ce833b2324ba ("KVM: VMX: Prepend "MAX_" to MSR array size defines") 7e34fbd05c63 ("KVM: x86: Rename "shared_msrs" to "user_return_msrs"") 8d22b90e942c ("KVM: SVM: refactor exit labels in svm_create_vcpu") 0681de1b8369 ("KVM: SVM: use __GFP_ZERO instead of clear_page") f4c847a95654 ("KVM: SVM: refactor msr permission bitmap allocation") 0dd16b5b0c9b ("KVM: nSVM: rename nested vmcb to vmcb12") 1feaba144cd3 ("KVM: SVM: rename a variable in the svm_create_vcpu") bf3c0e5e7102 ("Merge branch 'x86-seves-for-paolo' of https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into HEAD")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 16ae56d7e0528559bf8dc9070e3bfd8ba3de80df Mon Sep 17 00:00:00 2001 From: Maxim Levitsky mlevitsk@redhat.com Date: Thu, 3 Nov 2022 16:13:44 +0200 Subject: [PATCH] KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in use
Make sure that KVM uses vmcb01 before freeing nested state, and warn if that is not the case.
This is a minimal fix for CVE-2022-3344 making the kernel print a warning instead of a kernel panic.
Cc: stable@vger.kernel.org Signed-off-by: Maxim Levitsky mlevitsk@redhat.com Message-Id: 20221103141351.50662-3-mlevitsk@redhat.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 4c620999d230..b02a3a1792f1 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1125,6 +1125,9 @@ void svm_free_nested(struct vcpu_svm *svm) if (!svm->nested.initialized) return;
+ if (WARN_ON_ONCE(svm->vmcb != svm->vmcb01.ptr)) + svm_switch_vmcb(svm, &svm->vmcb01); + svm_vcpu_free_msrpm(svm->nested.msrpm); svm->nested.msrpm = NULL;