linux-kernel - Re: [PATCH] kvm: x86: skip populating logical dest map if apic is not sw enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 14 Aug 2019 15:29:20 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Bandan Das <bsd@...hat.com>, kvm <kvm@...r.kernel.org>
Cc:     Radim Krčmář <rkrcmar@...hat.com>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] kvm: x86: skip populating logical dest map if apic is not
 sw enabled

On 14/08/19 05:37, Bandan Das wrote:
> 
> recalculate_apic_map does not santize ldr and it's possible that
> multiple bits are set. In that case, a previous valid entry
> can potentially be overwritten by an invalid one.
> 
> This condition is hit when booting a 32 bit, >8 CPU, RHEL6 guest and then
> triggering a crash to boot a kdump kernel. This is the sequence of
> events:
> 1. Linux boots in bigsmp mode and enables PhysFlat, however, it still
> writes to the LDR which probably will never be used.
> 2. However, when booting into kdump, the stale LDR values remain as
> they are not cleared by the guest and there isn't a apic reset.
> 3. kdump boots with 1 cpu, and uses Logical Destination Mode but the
> logical map has been overwritten and points to an inactive vcpu.
> 
> Signed-off-by: Radim Krcmar <rkrcmar@...hat.com>
> Signed-off-by: Bandan Das <bsd@...hat.com>
> ---
>  arch/x86/kvm/lapic.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index 685d17c11461..e904ff06a83d 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -216,6 +216,9 @@ static void recalculate_apic_map(struct kvm *kvm)
>  		if (!apic_x2apic_mode(apic) && !new->phys_map[xapic_id])
>  			new->phys_map[xapic_id] = apic;
>  
> +		if (!kvm_apic_sw_enabled(apic))
> +			continue;
> +
>  		ldr = kvm_lapic_get_reg(apic, APIC_LDR);
>  
>  		if (apic_x2apic_mode(apic)) {
> @@ -258,6 +261,8 @@ static inline void apic_set_spiv(struct kvm_lapic *apic, u32 val)
>  			static_key_slow_dec_deferred(&apic_sw_disabled);
>  		else
>  			static_key_slow_inc(&apic_sw_disabled.key);
> +
> +		recalculate_apic_map(apic->vcpu->kvm);
>  	}
>  }
>  
> 

Queued, thanks.

Paolo