linux-kernel - Re: [PATCH 1/1] KVM: SVM: do not zero out segment attributes if segment is unusable or not present

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 1 Jun 2017 11:22:00 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Roman Pen <roman.penyaev@...fitbricks.com>
Cc:     Mikhail Sennikovskii <mikhail.sennikovskii@...fitbricks.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] KVM: SVM: do not zero out segment attributes if
 segment is unusable or not present



On 01/06/2017 10:55, Roman Pen wrote:
> This is a fix for the problem [1], where VMCB.CPL was set to 0 and interrupt
> was taken on userspace stack.  The root cause lies in the specific AMD CPU
> behaviour which manifests itself as unusable segment attributes on SYSRET.
> The corresponding work around for the kernel is the following:
> 
> 61f01dd941ba ("x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue")
> 
> In other turn virtualization side treated unusable segment incorrectly and
> restored CPL from SS attributes, which were zeroed out few lines above.
> 
> In current patch it is assured only that P bit is cleared in VMCB.save state
> and segment attributes are not zeroed out if segment is not presented or is
> unusable, therefore CPL can be safely restored from DPL field.
> 
> This is only one part of the fix, since QEMU side should be fixed accordingly
> not to zero out attributes on its side.  Corresponding patch will follow.
> 
> [1] Message id: CAJrWOzD6Xq==b-zYCDdFLgSRMPM-NkNuTSDFEtX=7MreT45i7Q@...l.gmail.com
> 
> Signed-off-by: Roman Pen <roman.penyaev@...fitbricks.com>
> Signed-off-by: Mikhail Sennikovskii <mikhail.sennikovskii@...fitbricks.com>
> Cc: Paolo Bonzini <pbonzini@...hat.com>
> Cc: Radim Krčmář <rkrcmar@...hat.com>
> Cc: kvm@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> ---
>  arch/x86/kvm/svm.c | 24 +++++++++++-------------
>  1 file changed, 11 insertions(+), 13 deletions(-)

Queued, thanks!

Paolo