From: Vitaly Kuznetsov vkuznets@redhat.com

commit 7ec37d1cbe17d8189d9562178d8b29167fe1c31a upstream

When KVM_CAP_HYPERV_SYNIC{,2} is activated, KVM already checks for irqchip_in_kernel() so normally SynIC irqs should never be set. It is, however, possible for a misbehaving VMM to write to SYNIC/STIMER MSRs causing erroneous behavior.

The immediate issue being fixed is that kvm_irq_delivery_to_apic() (kvm_irq_delivery_to_apic_fast()) crashes when called with 'irq.shorthand = APIC_DEST_SELF' and 'src == NULL'.

Signed-off-by: Vitaly Kuznetsov vkuznets@redhat.com Message-Id: 20220325132140.25650-2-vkuznets@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com --- arch/x86/kvm/hyperv.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c index 5497eeef4e70..ae9c45590b7e 100644 --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -317,6 +317,9 @@ static int synic_set_irq(struct kvm_vcpu_hv_synic *synic, u32 sint) struct kvm_lapic_irq irq; int ret, vector;

+ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) + return -EINVAL; + if (sint >= ARRAY_SIZE(synic->sint)) return -EINVAL;

From: Vitaly Kuznetsov vkuznets@redhat.com

commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream

When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON() instead of crashing the host.

Signed-off-by: Vitaly Kuznetsov vkuznets@redhat.com Message-Id: 20220325132140.25650-3-vkuznets@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com --- arch/x86/kvm/lapic.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 99b3fa3a29bf..4305f094d2c5 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -894,6 +894,10 @@ bool kvm_irq_delivery_to_apic_fast(struct kvm *kvm, struct kvm_lapic *src, *r = -1;

if (irq->shorthand == APIC_DEST_SELF) { + if (KVM_BUG_ON(!src, kvm)) { + *r = 0; + return true; + } *r = kvm_apic_set_irq(src->vcpu, irq, dest_map); return true; }

On 8/10/22 22:26, Stefan Ghinea wrote:

From: Sean Christopherson sean.j.christopherson@intel.com

commit 0b8f11737cffc1a406d1134b58687abc29d76b52 upstream

Signed-off-by: Sean Christopherson sean.j.christopherson@intel.com Signed-off-by: Isaku Yamahata isaku.yamahata@intel.com Reviewed-by: Paolo Bonzini pbonzini@redhat.com Message-Id: 3a0998645c328bf0895f1290e61821b70f048549.1625186503.git.isaku.yamahata@intel.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com [SG: Adjusted context for kernel version 4.14] Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com

---

include/linux/kvm_host.h | 28 +++++++++++++++++++++++++++- virt/kvm/kvm_main.c | 10 +++++----- 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index d5e38ebcfa47..2c6a321899e8 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -127,6 +127,7 @@ static inline bool is_error_page(struct page *page) #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) #define KVM_REQ_PENDING_TIMER 2 #define KVM_REQ_UNHALT 3 +#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) #define KVM_REQUEST_ARCH_BASE 8 #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \ @@ -446,6 +447,7 @@ struct kvm { struct kvm_stat_data **debugfs_stat_data; struct srcu_struct srcu; struct srcu_struct irq_srcu;

• bool vm_bugged; pid_t userspace_pid; };

@@ -475,6 +477,31 @@ struct kvm { #define vcpu_err(vcpu, fmt, ...) \ kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) +bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); +static inline void kvm_vm_bugged(struct kvm *kvm) +{

• kvm->vm_bugged = true;
• kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED);

+}

+#define KVM_BUG(cond, kvm, fmt...) \ +({ \

• int __ret = (cond); \

• 						\
  

• if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \

• kvm_vm_bugged(kvm);				\
  

• unlikely(__ret); \

+})

+#define KVM_BUG_ON(cond, kvm) \ +({ \

• int __ret = (cond); \

• 						\
  

• if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \

• kvm_vm_bugged(kvm);				\
  

• unlikely(__ret); \

+})

• static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) { return srcu_dereference_check(kvm->buses[idx], &kvm->srcu,

@@ -732,7 +759,6 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu); void kvm_flush_remote_tlbs(struct kvm *kvm); void kvm_reload_remote_mmus(struct kvm *kvm); -bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); long kvm_arch_dev_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg); diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 87d522eefbb4..7c4de635f00a 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -2660,7 +2660,7 @@ static long kvm_vcpu_ioctl(struct file *filp, struct kvm_fpu *fpu = NULL; struct kvm_sregs *kvm_sregs = NULL;

• if (vcpu->kvm->mm != current->mm)

• if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) return -EIO;

if (unlikely(_IOC_TYPE(ioctl) != KVMIO)) @@ -2864,7 +2864,7 @@ static long kvm_vcpu_compat_ioctl(struct file *filp, void __user *argp = compat_ptr(arg); int r;

• if (vcpu->kvm->mm != current->mm)

• if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) return -EIO;

switch (ioctl) { @@ -2922,7 +2922,7 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, { struct kvm_device *dev = filp->private_data;

• if (dev->kvm->mm != current->mm)

• if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged) return -EIO;

switch (ioctl) { @@ -3087,7 +3087,7 @@ static long kvm_vm_ioctl(struct file *filp, void __user *argp = (void __user *)arg; int r;

• if (kvm->mm != current->mm)

• if (kvm->mm != current->mm || kvm->vm_bugged) return -EIO; switch (ioctl) { case KVM_CREATE_VCPU:

@@ -3264,7 +3264,7 @@ static long kvm_vm_compat_ioctl(struct file *filp, struct kvm *kvm = filp->private_data; int r;

• if (kvm->mm != current->mm)

• if (kvm->mm != current->mm || kvm->vm_bugged) return -EIO; switch (ioctl) { case KVM_GET_DIRTY_LOG: {

Acked-by: Paolo Bonzini pbonzini@redhat.com