lkml.org 
[lkml]   [2021]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 011/178] kvm: LAPIC: Restore guard to prevent illegal APIC register access
    Date
    From: Jim Mattson <jmattson@google.com>

    [ Upstream commit 218bf772bddd221489c38dde6ef8e917131161f6 ]

    Per the SDM, "any access that touches bytes 4 through 15 of an APIC
    register may cause undefined behavior and must not be executed."
    Worse, such an access in kvm_lapic_reg_read can result in a leak of
    kernel stack contents. Prior to commit 01402cf81051 ("kvm: LAPIC:
    write down valid APIC registers"), such an access was explicitly
    disallowed. Restore the guard that was removed in that commit.

    Fixes: 01402cf81051 ("kvm: LAPIC: write down valid APIC registers")
    Signed-off-by: Jim Mattson <jmattson@google.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Message-Id: <20210602205224.3189316-1-jmattson@google.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/kvm/lapic.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
    index fa023f3feb25..43013ac0fd4d 100644
    --- a/arch/x86/kvm/lapic.c
    +++ b/arch/x86/kvm/lapic.c
    @@ -1410,6 +1410,9 @@ int kvm_lapic_reg_read(struct kvm_lapic *apic, u32 offset, int len,
    if (!apic_x2apic_mode(apic))
    valid_reg_mask |= APIC_REG_MASK(APIC_ARBPRI);

    + if (alignment + len > 4)
    + return 1;
    +
    if (offset > 0x3f0 || !(valid_reg_mask & APIC_REG_MASK(offset)))
    return 1;

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-06-21 18:39    [W:8.529 / U:0.856 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site