linux-kernel - [tip: x86/urgent] x86/apic: Include the LDR when clearing out APIC registers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <156683464551.2626.4210379148616708417.tip-bot2@tip-bot2>
Date:   Mon, 26 Aug 2019 15:50:45 -0000
From:   tip-bot2 for Bandan Das <tip-bot2@...utronix.de>
To:     linux-tip-commits@...r.kernel.org
Cc:     Bandan Das <bsd@...hat.com>, Thomas Gleixner <tglx@...utronix.de>,
        stable@...r.kernel.org, Ingo Molnar <mingo@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: [tip: x86/urgent] x86/apic: Include the LDR when clearing out APIC registers

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     cfa16294b1c5b320c0a0e1cac37c784b92366c87
Gitweb:        https://git.kernel.org/tip/cfa16294b1c5b320c0a0e1cac37c784b92366c87
Author:        Bandan Das <bsd@...hat.com>
AuthorDate:    Mon, 26 Aug 2019 06:15:13 -04:00
Committer:     Thomas Gleixner <tglx@...utronix.de>
CommitterDate: Mon, 26 Aug 2019 17:47:24 +02:00

x86/apic: Include the LDR when clearing out APIC registers

Although APIC initialization will typically clear out the LDR before
setting it, the APIC cleanup code should reset the LDR.

This was discovered with a 32-bit KVM guest jumping into a kdump
kernel. The stale bits in the LDR triggered a bug in the KVM APIC
implementation which caused the destination mapping for VCPUs to be
corrupted.

Note that this isn't intended to paper over the KVM APIC bug. The kernel
has to clear the LDR when resetting the APIC registers except when X2APIC
is enabled.

This lacks a Fixes tag because missing to clear LDR goes way back into pre
git history.

Signed-off-by: Bandan Das <bsd@...hat.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: stable@...r.kernel.org
Link: https://lkml.kernel.org/r20190826101513.5080-3-bsd@redhat.com
---
 arch/x86/kernel/apic/apic.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index aa5495d..e75f378 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1179,6 +1179,10 @@ void clear_local_APIC(void)
 	apic_write(APIC_LVT0, v | APIC_LVT_MASKED);
 	v = apic_read(APIC_LVT1);
 	apic_write(APIC_LVT1, v | APIC_LVT_MASKED);
+	if (!x2apic_enabled) {
+		v = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
+		apic_write(APIC_LDR, v);
+	}
 	if (maxlvt >= 4) {
 		v = apic_read(APIC_LVTPC);
 		apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);