Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1269615

[PATCH 3.2 58/60] KVM: x86: work around infinite loop in microcode when #AC is delivered

From Ben Hutchings <ben@decadent.org.uk>
Newsgroups linux.kernel
Subject [PATCH 3.2 58/60] KVM: x86: work around infinite loop in microcode when #AC is delivered
Date 2015-11-15 03:20 +0100
Message-ID <quV59-3JS-55@gated-at.bofh.it> (permalink)
References <quUVr-3GF-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Northup <digitaleric@google.com>

commit 54a20552e1eae07aa240fa370a0293e006b5faed upstream.

It was found that a guest can DoS a host by triggering an infinite
stream of "alignment check" (#AC) exceptions.  This causes the
microcode to enter an infinite loop where the core never receives
another interrupt.  The host kernel panics pretty quickly due to the
effects (CVE-2015-5307).

Signed-off-by: Eric Northup <digitaleric@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.2:
 - Add definition of AC_VECTOR
 - Adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1014,6 +1014,7 @@ static void init_vmcb(struct vcpu_svm *s
 	set_exception_intercept(svm, PF_VECTOR);
 	set_exception_intercept(svm, UD_VECTOR);
 	set_exception_intercept(svm, MC_VECTOR);
+	set_exception_intercept(svm, AC_VECTOR);
 
 	set_intercept(svm, INTERCEPT_INTR);
 	set_intercept(svm, INTERCEPT_NMI);
@@ -1689,6 +1690,12 @@ static int ud_interception(struct vcpu_s
 	return 1;
 }
 
+static int ac_interception(struct vcpu_svm *svm)
+{
+	kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
+	return 1;
+}
+
 static void svm_fpu_activate(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
@@ -3188,6 +3195,7 @@ static int (*svm_exit_handlers[])(struct
 	[SVM_EXIT_EXCP_BASE + PF_VECTOR]	= pf_interception,
 	[SVM_EXIT_EXCP_BASE + NM_VECTOR]	= nm_interception,
 	[SVM_EXIT_EXCP_BASE + MC_VECTOR]	= mc_interception,
+	[SVM_EXIT_EXCP_BASE + AC_VECTOR]	= ac_interception,
 	[SVM_EXIT_INTR]				= intr_interception,
 	[SVM_EXIT_NMI]				= nmi_interception,
 	[SVM_EXIT_SMI]				= nop_on_interception,
--- a/arch/x86/kvm/trace.h
+++ b/arch/x86/kvm/trace.h
@@ -244,6 +244,7 @@ TRACE_EVENT(kvm_apic,
 	{ SVM_EXIT_EXCP_BASE + UD_VECTOR,	"UD excp" }, \
 	{ SVM_EXIT_EXCP_BASE + PF_VECTOR,	"PF excp" }, \
 	{ SVM_EXIT_EXCP_BASE + NM_VECTOR,	"NM excp" }, \
+	{ SVM_EXIT_EXCP_BASE + AC_VECTOR,       "AC excp" }, \
 	{ SVM_EXIT_EXCP_BASE + MC_VECTOR,	"MC excp" }, \
 	{ SVM_EXIT_INTR,			"interrupt" }, \
 	{ SVM_EXIT_NMI,				"nmi" }, \
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1171,7 +1171,7 @@ static void update_exception_bitmap(stru
 	u32 eb;
 
 	eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
-	     (1u << NM_VECTOR) | (1u << DB_VECTOR);
+	     (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR);
 	if ((vcpu->guest_debug &
 	     (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
 	    (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
@@ -4266,6 +4266,9 @@ static int handle_exception(struct kvm_v
 
 	ex_no = intr_info & INTR_INFO_VECTOR_MASK;
 	switch (ex_no) {
+	case AC_VECTOR:
+		kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
+		return 1;
 	case DB_VECTOR:
 		dr6 = vmcs_readl(EXIT_QUALIFICATION);
 		if (!(vcpu->guest_debug &
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -83,6 +83,7 @@
 #define GP_VECTOR 13
 #define PF_VECTOR 14
 #define MF_VECTOR 16
+#define AC_VECTOR 17
 #define MC_VECTOR 18
 
 #define SELECTOR_TI_MASK (1 << 2)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.2 00/60] 3.2.73-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 43/60] dm btree remove: fix a bug when rebalancing  nodes after removal Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 27/60] 3w-9xxx: don't unmap bounce buffered commands Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 12/60] genirq: Fix race in register_irq_proc() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 31/60] iommu/vt-d: fix range computation when making  room for large pages Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 28/60] xen-blkfront: check for null drvdata in  blkback_changed (XenbusStateClosing) Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 32/60] xhci: don't finish a TD if we get a short  transfer event mid TD Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 46/60] md/raid1: don't clear bitmap bit when  bad-block-list write fails. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 24/60] iwlwifi: dvm: fix D3 firmware PN programming Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 04/60] regmap: debugfs: Don't bother actually printing  when calculating max length Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
  [PATCH 3.2 55/60] asix: Don't reset PHY on if_up for ASIX 88772 Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 08/60] UBI: Validate data_size Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 53/60] skbuff: Fix skb checksum partial check. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 38/60] IB/cm: Fix rb-tree duplicate free and  use-after-free Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 20/60] usb: Add device quirk for Logitech PTZ cameras Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 33/60] xhci: handle no ping response error properly Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 19/60] USB: Add reset-resume quirk for two Plantronics  usb headphones. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 44/60] dm btree: fix leak of bufio-backed block in  btree_split_beneath error path Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 40/60] powerpc/rtas: Validate rtas.entry before  calling enter_rtas() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 34/60] xhci: Switch Intel Lynx Point LP ports to EHCI  on shutdown. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 07/60] x86/xen: Do not clip xen_e820_map to  xen_e820_map_entries when sanitizing map Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 03/60] regmap: debugfs: Ensure we don't underflow when  printing access masks Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 51/60] net: add length argument to  skb_copy_and_csum_datagram_iovec Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 05/60] ath9k: declare required extra tx headroom Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 39/60] drm/nouveau/gem: return only valid domain when  there's only one Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 06/60] m68k: Define asmlinkage_protect Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 26/60] sched/core: Fix TASK_DEAD race in  finish_task_switch() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 45/60] md/raid1: ensure device failure recorded before  write request returns. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 15/60] md/raid0: update queue parameter in a safer  location. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 59/60] KEYS: Fix race between key destruction and  finding a keyring by name Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 23/60] ppp: don't override sk->sk_state in  pppoe_flush_dev() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 49/60] mvsas: Fix NULL pointer dereference in  mvs_slot_task_free Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 58/60] KVM: x86: work around infinite loop in  microcode when #AC is delivered Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
  [PATCH 3.2 42/60] ppp: fix pppoe_dev deletion condition in  pppoe_release() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  [PATCH 3.2 10/60] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  [PATCH 3.2 50/60] sched: declare pid_alive as inline Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  [PATCH 3.2 17/60] clocksource: Fix abs() usage w/ 64bit values Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  [PATCH 3.2 36/60] crypto: api - Only abort operations on fatal signal Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  [PATCH 3.2 16/60] md/raid0: apply base queue limits *before*  disk_stack_limits Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  [PATCH 3.2 47/60] md/raid10: ensure device failure recorded  before write request returns. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  [PATCH 3.2 57/60] Failing to send a CLOSE if file is opened  WRONLY and server reboots on a 4.x mount Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  [PATCH 3.2 14/60] [SMB3] Do not fall back to SMBWriteX in  set_file_size error cases Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
  Re: [PATCH 3.2 00/60] 3.2.73-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-11-15 14:50 +0100
    Re: [PATCH 3.2 00/60] 3.2.73-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-11-16 12:20 +0100

csiph-web