| Message ID | 1550581355-7068-4-git-send-email-paolo.pisati@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | CVE-2018-18021 - arm64 KVM DoS/privesc | expand |
On 2019-02-19 14:02:35, Paolo Pisati wrote: > From: Marc Zyngier <marc.zyngier@arm.com> > > Not all execution modes are valid for a guest, and some of them > depend on what the HW actually supports. Let's verify that what > userspace provides is compatible with both the VM settings and > the HW capabilities. > > Cc: <stable@vger.kernel.org> > Fixes: 0d854a60b1d7 ("arm64: KVM: enable initialization of a 32bit vcpu") > Reviewed-by: Christoffer Dall <christoffer.dall@arm.com> > Reviewed-by: Mark Rutland <mark.rutland@arm.com> > Reviewed-by: Dave Martin <Dave.Martin@arm.com> > Signed-off-by: Marc Zyngier <marc.zyngier@arm.com> > Signed-off-by: Will Deacon <will.deacon@arm.com> Needs the CVE id here: CVE-2018-18021 > (cherry picked from commit 2a3f93459d689d990b3ecfbe782fec89b97d3279) This technically isn't a cherry pick since you had to change PSR_AA32_MODE_MASK to COMPAT_PSR_MODE_MASK. This line should be: (backported from commit 2a3f93459d689d990b3ecfbe782fec89b97d3279) > Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com> With those two changes: Acked-by: Tyler Hicks <tyhicks@canonical.com> Thanks for testing these patches. Tyler > --- > arch/arm64/kvm/guest.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c > index 3f4817d..76d27ed 100644 > --- a/arch/arm64/kvm/guest.c > +++ b/arch/arm64/kvm/guest.c > @@ -152,17 +152,25 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) > } > > if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) { > - u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK; > + u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK; > switch (mode) { > case COMPAT_PSR_MODE_USR: > + if (!system_supports_32bit_el0()) > + return -EINVAL; > + break; > case COMPAT_PSR_MODE_FIQ: > case COMPAT_PSR_MODE_IRQ: > case COMPAT_PSR_MODE_SVC: > case COMPAT_PSR_MODE_ABT: > case COMPAT_PSR_MODE_UND: > + if (!vcpu_el1_is_32bit(vcpu)) > + return -EINVAL; > + break; > case PSR_MODE_EL0t: > case PSR_MODE_EL1t: > case PSR_MODE_EL1h: > + if (vcpu_el1_is_32bit(vcpu)) > + return -EINVAL; > break; > default: > err = -EINVAL; > -- > 2.7.4 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team
diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c index 3f4817d..76d27ed 100644 --- a/arch/arm64/kvm/guest.c +++ b/arch/arm64/kvm/guest.c @@ -152,17 +152,25 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) } if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) { - u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK; + u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK; switch (mode) { case COMPAT_PSR_MODE_USR: + if (!system_supports_32bit_el0()) + return -EINVAL; + break; case COMPAT_PSR_MODE_FIQ: case COMPAT_PSR_MODE_IRQ: case COMPAT_PSR_MODE_SVC: case COMPAT_PSR_MODE_ABT: case COMPAT_PSR_MODE_UND: + if (!vcpu_el1_is_32bit(vcpu)) + return -EINVAL; + break; case PSR_MODE_EL0t: case PSR_MODE_EL1t: case PSR_MODE_EL1h: + if (vcpu_el1_is_32bit(vcpu)) + return -EINVAL; break; default: err = -EINVAL;