From: Vitaly Kuznetsov vkuznets@redhat.com

commit 7ec37d1cbe17d8189d9562178d8b29167fe1c31a upstream

When KVM_CAP_HYPERV_SYNIC{,2} is activated, KVM already checks for irqchip_in_kernel() so normally SynIC irqs should never be set. It is, however, possible for a misbehaving VMM to write to SYNIC/STIMER MSRs causing erroneous behavior.

The immediate issue being fixed is that kvm_irq_delivery_to_apic() (kvm_irq_delivery_to_apic_fast()) crashes when called with 'irq.shorthand = APIC_DEST_SELF' and 'src == NULL'.

Signed-off-by: Vitaly Kuznetsov vkuznets@redhat.com Message-Id: 20220325132140.25650-2-vkuznets@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com --- arch/x86/kvm/hyperv.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c index ca66459a2e89..f9603df799bf 100644 --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -309,6 +309,9 @@ static int synic_set_irq(struct kvm_vcpu_hv_synic *synic, u32 sint) struct kvm_lapic_irq irq; int ret, vector;

+ if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) + return -EINVAL; + if (sint >= ARRAY_SIZE(synic->sint)) return -EINVAL;

From: Vitaly Kuznetsov vkuznets@redhat.com

commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream

When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON() instead of crashing the host.

Signed-off-by: Vitaly Kuznetsov vkuznets@redhat.com Message-Id: 20220325132140.25650-3-vkuznets@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com --- arch/x86/kvm/lapic.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 3696b4de9d99..23480d8e4ef1 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -955,6 +955,10 @@ bool kvm_irq_delivery_to_apic_fast(struct kvm *kvm, struct kvm_lapic *src, *r = -1;

if (irq->shorthand == APIC_DEST_SELF) { + if (KVM_BUG_ON(!src, kvm)) { + *r = 0; + return true; + } *r = kvm_apic_set_irq(src->vcpu, irq, dest_map); return true; }

On 8/10/22 22:25, Stefan Ghinea wrote:

From: Sean Christopherson sean.j.christopherson@intel.com

commit 0b8f11737cffc1a406d1134b58687abc29d76b52 upstream

Signed-off-by: Sean Christopherson sean.j.christopherson@intel.com Signed-off-by: Isaku Yamahata isaku.yamahata@intel.com Reviewed-by: Paolo Bonzini pbonzini@redhat.com Message-Id: 3a0998645c328bf0895f1290e61821b70f048549.1625186503.git.isaku.yamahata@intel.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com [SG: Adjusted context for kernel version 5.4] Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com

---

include/linux/kvm_host.h | 28 +++++++++++++++++++++++++++- virt/kvm/kvm_main.c | 10 +++++----- 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 19e8344c51a8..dd4cdad76b18 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -146,6 +146,7 @@ static inline bool is_error_page(struct page *page) #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) #define KVM_REQ_PENDING_TIMER 2 #define KVM_REQ_UNHALT 3 +#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) #define KVM_REQUEST_ARCH_BASE 8 #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \ @@ -502,6 +503,7 @@ struct kvm { struct srcu_struct srcu; struct srcu_struct irq_srcu; pid_t userspace_pid;

• bool vm_bugged; };

#define kvm_err(fmt, ...) \ @@ -530,6 +532,31 @@ struct kvm { #define vcpu_err(vcpu, fmt, ...) \ kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) +bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); +static inline void kvm_vm_bugged(struct kvm *kvm) +{

• kvm->vm_bugged = true;
• kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED);

+}

+#define KVM_BUG(cond, kvm, fmt...) \ +({ \

• int __ret = (cond); \

• 						\
  

• if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \

• kvm_vm_bugged(kvm);				\
  

• unlikely(__ret); \

+})

+#define KVM_BUG_ON(cond, kvm) \ +({ \

• int __ret = (cond); \

• 						\
  

• if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \

• kvm_vm_bugged(kvm);				\
  

• unlikely(__ret); \

+})

• static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) { return srcu_dereference_check(kvm->buses[idx], &kvm->srcu,

@@ -790,7 +817,6 @@ void kvm_reload_remote_mmus(struct kvm *kvm); bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req, unsigned long *vcpu_bitmap, cpumask_var_t tmp); -bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); long kvm_arch_dev_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg); diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 287444e52ccf..ec1cd059816d 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -2937,7 +2937,7 @@ static long kvm_vcpu_ioctl(struct file *filp, struct kvm_fpu *fpu = NULL; struct kvm_sregs *kvm_sregs = NULL;

• if (vcpu->kvm->mm != current->mm)

• if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) return -EIO;

if (unlikely(_IOC_TYPE(ioctl) != KVMIO)) @@ -3144,7 +3144,7 @@ static long kvm_vcpu_compat_ioctl(struct file *filp, void __user *argp = compat_ptr(arg); int r;

• if (vcpu->kvm->mm != current->mm)

• if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged) return -EIO;

switch (ioctl) { @@ -3209,7 +3209,7 @@ static long kvm_device_ioctl(struct file *filp, unsigned int ioctl, { struct kvm_device *dev = filp->private_data;

• if (dev->kvm->mm != current->mm)

• if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged) return -EIO;

switch (ioctl) { @@ -3410,7 +3410,7 @@ static long kvm_vm_ioctl(struct file *filp, void __user *argp = (void __user *)arg; int r;

• if (kvm->mm != current->mm)

• if (kvm->mm != current->mm || kvm->vm_bugged) return -EIO; switch (ioctl) { case KVM_CREATE_VCPU:

@@ -3618,7 +3618,7 @@ static long kvm_vm_compat_ioctl(struct file *filp, struct kvm *kvm = filp->private_data; int r;

• if (kvm->mm != current->mm)

• if (kvm->mm != current->mm || kvm->vm_bugged) return -EIO; switch (ioctl) { #ifdef CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT

Acked-by: Paolo Bonzini pbonzini@redhat.com