From: Vitaly Kuznetsov vkuznets@redhat.com

commit 7ec37d1cbe17d8189d9562178d8b29167fe1c31a upstream

When KVM_CAP_HYPERV_SYNIC{,2} is activated, KVM already checks for irqchip_in_kernel() so normally SynIC irqs should never be set. It is, however, possible for a misbehaving VMM to write to SYNIC/STIMER MSRs causing erroneous behavior.

The immediate issue being fixed is that kvm_irq_delivery_to_apic() (kvm_irq_delivery_to_apic_fast()) crashes when called with 'irq.shorthand = APIC_DEST_SELF' and 'src == NULL'.

Signed-off-by: Vitaly Kuznetsov vkuznets@redhat.com Message-Id: 20220325132140.25650-2-vkuznets@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com --- arch/x86/kvm/hyperv.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c index d806139377bc..09ec1cda2d68 100644 --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -428,6 +428,9 @@ static int synic_set_irq(struct kvm_vcpu_hv_synic *synic, u32 sint) struct kvm_lapic_irq irq; int ret, vector;

+ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) + return -EINVAL; + if (sint >= ARRAY_SIZE(synic->sint)) return -EINVAL;

From: Vitaly Kuznetsov vkuznets@redhat.com

commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream

When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON() instead of crashing the host.

Signed-off-by: Vitaly Kuznetsov vkuznets@redhat.com Message-Id: 20220325132140.25650-3-vkuznets@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com --- arch/x86/kvm/lapic.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 6ed6b090be94..260727eaa6b9 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -991,6 +991,10 @@ bool kvm_irq_delivery_to_apic_fast(struct kvm *kvm, struct kvm_lapic *src, *r = -1;

if (irq->shorthand == APIC_DEST_SELF) { + if (KVM_BUG_ON(!src, kvm)) { + *r = 0; + return true; + } *r = kvm_apic_set_irq(src->vcpu, irq, dest_map); return true; }

On 8/10/22 22:24, Stefan Ghinea wrote:

From: Sean Christopherson sean.j.christopherson@intel.com

commit 0b8f11737cffc1a406d1134b58687abc29d76b52 upstream

Signed-off-by: Sean Christopherson sean.j.christopherson@intel.com Signed-off-by: Isaku Yamahata isaku.yamahata@intel.com Reviewed-by: Paolo Bonzini pbonzini@redhat.com Message-Id: 3a0998645c328bf0895f1290e61821b70f048549.1625186503.git.isaku.yamahata@intel.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com [SG: Adjusted context for kernel version 5.10] Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com

---

include/linux/kvm_host.h | 28 +++++++++++++++++++++++++++- virt/kvm/kvm_main.c | 10 +++++----- 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 439fbe0ee0c7..94871f12e536 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -146,6 +146,7 @@ static inline bool is_error_page(struct page *page) #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) #define KVM_REQ_PENDING_TIMER 2 #define KVM_REQ_UNHALT 3 +#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) #define KVM_REQUEST_ARCH_BASE 8 #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \ @@ -505,6 +506,7 @@ struct kvm { struct srcu_struct irq_srcu; pid_t userspace_pid; unsigned int max_halt_poll_ns;

• bool vm_bugged; };

#define kvm_err(fmt, ...) \ @@ -533,6 +535,31 @@ struct kvm { #define vcpu_err(vcpu, fmt, ...) \ kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) +bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); +static inline void kvm_vm_bugged(struct kvm *kvm) +{

• kvm->vm_bugged = true;
• kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED);

+}

+#define KVM_BUG(cond, kvm, fmt...) \ +({ \

• int __ret = (cond); \

• 						\
  

• if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \

• kvm_vm_bugged(kvm);				\
  

• unlikely(__ret); \

+})

+#define KVM_BUG_ON(cond, kvm) \ +({ \

• int __ret = (cond); \

• 						\
  

• if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \

• kvm_vm_bugged(kvm);				\
  

• unlikely(__ret); \

+})

• static inline bool kvm_dirty_log_manual_protect_and_init_set(struct kvm *kvm) { return !!(kvm->manual_dirty_log_protect & KVM_DIRTY_LOG_INITIALLY_SET);

@@ -850,7 +877,6 @@ void *kvm_mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc); bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req, struct kvm_vcpu *except, unsigned long *vcpu_bitmap, cpumask_var_t tmp); -bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); bool kvm_make_all_cpus_request_except(struct kvm *kvm, unsigned int req, struct kvm_vcpu *except); bool kvm_make_cpus_request_mask(struct kvm *kvm, unsigned int req, diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index c5dbac10c372..bb7adddd6a85 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -3252,7 +3252,7 @@ static long kvm_vcpu_ioctl(struct file *filp, struct kvm_fpu *fpu = NULL; struct kvm_sregs *kvm_sregs = NULL;

• if (vcpu->kvm->mm != current->mm)

• if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) return -EIO;

if (unlikely(_IOC_TYPE(ioctl) != KVMIO)) @@ -3458,7 +3458,7 @@ static long kvm_vcpu_compat_ioctl(struct file *filp, void __user *argp = compat_ptr(arg); int r;

• if (vcpu->kvm->mm != current->mm)

• if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) return -EIO;

switch (ioctl) { @@ -3524,7 +3524,7 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, { struct kvm_device *dev = filp->private_data;

• if (dev->kvm->mm != current->mm)

• if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged) return -EIO;

switch (ioctl) { @@ -3743,7 +3743,7 @@ static long kvm_vm_ioctl(struct file *filp, void __user *argp = (void __user *)arg; int r;

• if (kvm->mm != current->mm)

• if (kvm->mm != current->mm || kvm->vm_bugged) return -EIO; switch (ioctl) { case KVM_CREATE_VCPU:

@@ -3948,7 +3948,7 @@ static long kvm_vm_compat_ioctl(struct file *filp, struct kvm *kvm = filp->private_data; int r;

• if (kvm->mm != current->mm)

• if (kvm->mm != current->mm || kvm->vm_bugged) return -EIO; switch (ioctl) { #ifdef CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT

Acked-by: Paolo Bonzini pbonzini@redhat.com