linux-kernel - Re: [STABLE 4.9.y PATCH 0/9] Backport of KVM Speculation Control support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 8 Feb 2018 18:14:36 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     "Woodhouse, David" <dwmw@...zon.co.uk>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Jim Mattson <jmattson@...gle.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        KarimAllah Ahmed <karahmed@...zon.de>, stable@...r.kernel.org
Subject: Re: [STABLE 4.9.y PATCH 0/9] Backport of KVM Speculation Control
 support

On Thu, Feb 08, 2018 at 03:49:59AM +0100, Greg KH wrote:
> On Tue, Feb 06, 2018 at 09:05:46PM +0000, Woodhouse, David wrote:
> > 
> > 
> > On Tue, 2018-02-06 at 19:01 +0100, Paolo Bonzini wrote:
> > > On 06/02/2018 18:29, David Woodhouse wrote:
> > > > I've put together a linux-4.9.y branch at 
> > > > http://git.infradead.org/retpoline-stable.git/shortlog/refs/heads/linux-4.9.y
> > > > 
> > > > Most of it is fairly straightforward, apart from the IBPB on context 
> > > > switch for which Tim has already posted a candidate. I wanted some more
> > > > review on my backports of the KVM bits though, including some extra
> > > > historical patches I pulled in.
> > > 
> > > Looks good!  Thanks for the work,
> > > 
> > > Paolo
> > 
> > Thanks. In that case, Greg, the full set is lined up in
> > http://git.infradead.org/retpoline-stable.git/shortlog/refs/heads/linux-4.9.y
> > or git://git.infradead.org/retpoline-stable linux-4.9.y
> 
> Many thanks for all of this work.  I've now queued up all of these.

There's a problem with the backport of 6342c50ad12e ("KVM: nVMX:
vmx_complete_nested_posted_interrupt() can't fail") as there is still a
check in the function that can fail:

		vapic_page = kmap(vmx->nested.virtual_apic_page);
		if (!vapic_page) {
			WARN_ON(1);
			return -ENOMEM;
		}

Do we need something else before this patch in order to fix this?  I
guess kmap really can't fail, should I just drop the whole (!vapic_page)
check?

thanks,

greg k-h