tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Browse Source 
Pull KVM fixes from Paolo Bonzini:
 "Three security fixes"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
  KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
  kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
This commit is contained in:
Linus Torvalds
2019-02-07 15:53:26 -07:00
parent ee6c0737a0 ecec76885b
commit e303a067ce
3 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/x86/kvm/vmx/nested.c
+1
View File
@@ -211,6 +211,7 @@ static void free_nested(struct kvm_vcpu *vcpu)
if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon) if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
return; return;
hrtimer_cancel(&vmx->nested.preemption_timer);
vmx->nested.vmxon = false; vmx->nested.vmxon = false;
vmx->nested.smm.vmxon = false; vmx->nested.smm.vmxon = false;
free_vpid(vmx->nested.vpid02); free_vpid(vmx->nested.vpid02);
arch/x86/kvm/x86.c
+7
View File
@@ -5116,6 +5116,13 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
{ {
u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0; u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
/*
* FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
* is returned, but our callers are not ready for that and they blindly
* call kvm_inject_page_fault. Ensure that they at least do not leak
* uninitialized kernel stack memory into cr2 and error code.
*/
memset(exception, 0, sizeof(*exception));
return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access, return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
exception); exception);
} }
virt/kvm/kvm_main.c
+2 -1
View File
@@ -3000,8 +3000,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
if (ops->init) if (ops->init)
ops->init(dev); ops->init(dev);
kvm_get_kvm(kvm);
ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
if (ret < 0) { if (ret < 0) {
kvm_put_kvm(kvm);
mutex_lock(&kvm->lock); mutex_lock(&kvm->lock);
list_del(&dev->vm_node); list_del(&dev->vm_node);
mutex_unlock(&kvm->lock); mutex_unlock(&kvm->lock);
@@ -3009,7 +3011,6 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
return ret; return ret;
} }
kvm_get_kvm(kvm);
cd->fd = ret; cd->fd = ret;
return 0; return 0;
} }