From patchwork Wed Oct 25 20:08:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yuxuan Luo X-Patchwork-Id: 1855284 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SG0Q10RT5z202k for ; Thu, 26 Oct 2023 07:09:29 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1qvkBp-0000bM-Js; Wed, 25 Oct 2023 20:09:17 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1qvkB8-0008KI-84 for kernel-team@lists.ubuntu.com; Wed, 25 Oct 2023 20:08:34 +0000 Received: from mail-qt1-f198.google.com (mail-qt1-f198.google.com [209.85.160.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id C6F9B4134E for ; Wed, 25 Oct 2023 20:08:33 +0000 (UTC) Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-41cb577d45aso2552411cf.3 for ; Wed, 25 Oct 2023 13:08:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1698264512; x=1698869312; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=gevN5XAHww4/MYRMLfn5sEKDd3HDwnYVyu2Xa8CG2qU=; b=F92hEOVQyfuyOLMTLV1dbonu4RCh1eFsjFnhAgnIExs0anrEAihq/gUFVtS7iYVCxK FLj/P77JxtWYp+1Bw4wYdxKKdYT2G0iNb4M10cvjJgrC/GKj/Gy5l8Q7xYxNwtkLQyYY aOQTYTiQqBQrzm1m5GP506RFdM6jTkQ67XXBabktlIa+yQoe/2xiOSQy/zlJnk3zW589 YXrnLL4RPleLZwlPbB4wpvYmlJ1fxlZSeWQO/1Hz0UfnAefHy/0HeTeTt6sqcoBlN5gH Jf/0sgQp1cNJdecF2Lt4wPbPsiK6mofy03oxTKX5Znn/w5w6FWYRuTndfzWSjnMWPAzX Uk9g== X-Gm-Message-State: AOJu0YzhUb9zn1ZnRgeypVRrehdllsmBD7TNwWk1sE4zJLZPKTm/tdkW 2B6wHrTkd4W+2cl5RoWKhDCaLStKb0teOkQ6yx7W6spWUtVZdwim5OW7KxSXG8oVuxWoVUv+9v3 YgQBjAsHu0Re8HN21aEXE6Cl4Lj5XxM3IhSHV/O+viEwvUemOCg== X-Received: by 2002:a05:622a:408:b0:41c:c587:6263 with SMTP id n8-20020a05622a040800b0041cc5876263mr20472196qtx.2.1698264512325; Wed, 25 Oct 2023 13:08:32 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFe5pomcEhQ61EvfVGVK9YU8PFZj7oB5q55WORY7PrCPVLhuBp+I73tfwqiVNbQf9L6AzF6KQ== X-Received: by 2002:a05:622a:408:b0:41c:c587:6263 with SMTP id n8-20020a05622a040800b0041cc5876263mr20472182qtx.2.1698264512020; Wed, 25 Oct 2023 13:08:32 -0700 (PDT) Received: from cache-ubuntu.hsd1.nj.comcast.net ([2601:86:200:98b0:374:b69b:f93:5e37]) by smtp.gmail.com with ESMTPSA id br14-20020a05622a1e0e00b00419c39dd28fsm4438296qtb.20.2023.10.25.13.08.31 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 25 Oct 2023 13:08:31 -0700 (PDT) From: Yuxuan Luo To: kernel-team@lists.ubuntu.com Subject: [SRU][OEM-6.1][Lunar][PATCH] x86: KVM: SVM: always update the x2avic msr interception Date: Wed, 25 Oct 2023 16:08:27 -0400 Message-Id: <20231025200828.53252-2-yuxuan.luo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20231025200828.53252-1-yuxuan.luo@canonical.com> References: <20231025200828.53252-1-yuxuan.luo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Maxim Levitsky The following problem exists since x2avic was enabled in the KVM: svm_set_x2apic_msr_interception is called to enable the interception of the x2apic msrs. In particular it is called at the moment the guest resets its apic. Assuming that the guest's apic was in x2apic mode, the reset will bring it back to the xapic mode. The svm_set_x2apic_msr_interception however has an erroneous check for '!apic_x2apic_mode()' which prevents it from doing anything in this case. As a result of this, all x2apic msrs are left unintercepted, and that exposes the bare metal x2apic (if enabled) to the guest. Oops. Remove the erroneous '!apic_x2apic_mode()' check to fix that. This fixes CVE-2023-5090 Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode") Cc: stable@vger.kernel.org Signed-off-by: Maxim Levitsky Reviewed-by: Suravee Suthikulpanit Tested-by: Suravee Suthikulpanit Reviewed-by: Sean Christopherson Message-Id: <20230928173354.217464-2-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini (backported from commit b65235f6e102354ccafda601eaa1c5bef5284d21) [yuxuan.luo: the refactoring at commit f628a34a9d52 ("KVM: SVM: Replace "avic_mode" enum with "x2avic_enabled" boolean") can be ignored ] CVE-2023-5090 Signed-off-by: Yuxuan Luo --- arch/x86/kvm/svm/svm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index fb9cde86930d3..cf31babfbbb9c 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -813,8 +813,7 @@ void svm_set_x2apic_msr_interception(struct vcpu_svm *svm, bool intercept) if (intercept == svm->x2avic_msrs_intercepted) return; - if (avic_mode != AVIC_MODE_X2 || - !apic_x2apic_mode(svm->vcpu.arch.apic)) + if (avic_mode != AVIC_MODE_X2) return; for (i = 0; i < MAX_DIRECT_ACCESS_MSRS; i++) {