linux-kernel - Re: [PATCH v1] KVM: x86: fix illegal MP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Mar 2017 17:49:33 +0100
From:   Radim Krčmář <rkrcmar@...hat.com>
To:     David Hildenbrand <david@...hat.com>
Cc:     kvm@...r.kernel.org, Paolo Bonzini <pbonzini@...hat.com>,
        Dmitry Vyukov <dvyukov@...gle.com>, stable@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v1] KVM: x86: fix illegal MP_STATE when in/entering SMM

2017-03-22 16:53+0100, David Hildenbrand:
> If we already entered/are about to enter SMM, don't allow
> switching to INIT/SIPI_RECEIVED, otherwise the next call to
> kvm_apic_accept_events() will report a warning.
> 
> Fixes: cd7764fe9f73 ("KVM: x86: latch INITs while in system management mode")
> Cc: stable@...r.kernel.org # 4.2+
> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
> Signed-off-by: David Hildenbrand <david@...hat.com>
> ---
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 1faf620..7d0ec1b 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -7355,6 +7355,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
>  	    mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
>  		return -EINVAL;
>  
> +	/* INITs are latched while in SMM */
> +	if ((is_smm(vcpu) || vcpu->arch.smi_pending) &&

I think that userspace can still set the mpstate first and then enter
SMM with KVM_SET_VCPU_EVENTS, which would result in the same warning ...
Don't we need a similar check in kvm_vcpu_ioctl_x86_set_vcpu_events()?

Thanks.

> +	    (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
> +	     mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
> +		return -EINVAL;
> +
>  	if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
>  		vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
>  		set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
> -- 
> 2.9.3
>