From patchwork Thu Sep 23 23:50:58 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1531971 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=OZj3WmDD; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4HFsQj4fMdz9t6g for ; Fri, 24 Sep 2021 09:52:13 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1mTYVX-0001to-Ss; Thu, 23 Sep 2021 23:52:03 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1mTYVV-0001t1-2o for kernel-team@lists.ubuntu.com; Thu, 23 Sep 2021 23:52:01 +0000 Received: from localhost.localdomain (1.general.cascardo.us.vpn [10.172.70.58]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id 2F929412AC for ; Thu, 23 Sep 2021 23:51:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1632441120; bh=2NmsvVDizGZX3dYfKLzpK2i8HJiy6YJHC+upPyqVyvk=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=OZj3WmDDKLeYGd8uU8vHIn9K0ZKZK20OcBSdPQvhme3+jUOzoZ7+cOvN42sTecDkM 6MKeJZCcN4NwyoyRTQmwugmryF/deAcvRGUEgk8cXenzqUwO6M9UUQ/Him6nupjybi 4QcEHisPzI4LgMrTuhvmcnL4VrJilxpRNUbrw7lQjix5nBKREqRGluaxhcwUF7iKA7 +F8izMp7Aaf9xQslW9OxaZpfAWzfcTr6CIlGJMsyEFqGxzaLCg31CR5vG/dpzfeKr1 41sxeE7xHjwqoXGoqzKDN5awWHQwi1EriPKc+dpnQ7RpMVURLYDQc4vzAvqIX5QK4Z DB59s1icn5Icw== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU focal/linux-hwe-5.8 1/4] net: ll_temac: Fix TX BD buffer overwrite Date: Thu, 23 Sep 2021 20:50:58 -0300 Message-Id: <20210923235101.49134-2-cascardo@canonical.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210923235101.49134-1-cascardo@canonical.com> References: <20210923235101.49134-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Esben Haabendal Just as the initial check, we need to ensure num_frag+1 buffers available, as that is the number of buffers we are going to use. This fixes a buffer overflow, which might be seen during heavy network load. Complete lockup of TEMAC was reproducible within about 10 minutes of a particular load. Fixes: 84823ff80f74 ("net: ll_temac: Fix race condition causing TX hang") Cc: stable@vger.kernel.org # v5.4+ Signed-off-by: Esben Haabendal Signed-off-by: David S. Miller (cherry picked from commit c364df2489b8ef2f5e3159b1dff1ff1fdb16040d) CVE-2021-38207 Signed-off-by: Thadeu Lima de Souza Cascardo --- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c index 030185301014..f8992e530549 100644 --- a/drivers/net/ethernet/xilinx/ll_temac_main.c +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c @@ -849,7 +849,7 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) smp_mb(); /* Space might have just been freed - check again */ - if (temac_check_tx_bd_space(lp, num_frag)) + if (temac_check_tx_bd_space(lp, num_frag + 1)) return NETDEV_TX_BUSY; netif_wake_queue(ndev); From patchwork Thu Sep 23 23:50:59 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1531970 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=s44sYARV; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4HFsQj3C6lz9tkW for ; Fri, 24 Sep 2021 09:52:13 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1mTYVY-0001u0-3g; Thu, 23 Sep 2021 23:52:04 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1mTYVW-0001tT-Ag for kernel-team@lists.ubuntu.com; Thu, 23 Sep 2021 23:52:02 +0000 Received: from localhost.localdomain (1.general.cascardo.us.vpn [10.172.70.58]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id 7D293412AC for ; Thu, 23 Sep 2021 23:52:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1632441122; bh=KeSh09KLJUJPM0cMbEd+pt62EKiTfgHc4YR+c/SftVQ=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=s44sYARVtR/iTjtU5XYXdPb7VSy8AVXkqIEAGK687HFPM7oYCOMlyV9SxaK78j6WG R2XvXx65Of+FZPOdmPXikX0Sjee2g7RGkiNjkg+0afRXLqP14lRJMD5Y6BrGBwXN8L +BrBr+9SwZLiuI8Vnp8nUSIB/naKFgYNuZP22wIsJyA62EX0UavmsSaDjtgWRi0yJs Jx0LIt8RUSAPR7kOMevGGMnD5KsB8CEzwd2ry1fbgYajnb9aBSPyXGJ59zgTMIzc7E WwT+YQN8+YOom7FbAv/gEeKGA23qclMnn8lzkB24FPSRe5XjjdVFyb/5A/pLmWgc8r uwDQ4+2zsYGew== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU focal/linux-hwe-5.8 2/4] Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl Date: Thu, 23 Sep 2021 20:50:59 -0300 Message-Id: <20210923235101.49134-3-cascardo@canonical.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210923235101.49134-1-cascardo@canonical.com> References: <20210923235101.49134-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Alexander Larkin Even though we validate user-provided inputs we then traverse past validated data when applying the new map. The issue was originally discovered by Murray McAllister with this simple POC (if the following is executed by an unprivileged user it will instantly panic the system): int main(void) { int fd, ret; unsigned int buffer[10000]; fd = open("/dev/input/js0", O_RDONLY); if (fd == -1) printf("Error opening file\n"); ret = ioctl(fd, JSIOCSBTNMAP & ~IOCSIZE_MASK, &buffer); printf("%d\n", ret); } The solution is to traverse internal buffer which is guaranteed to only contain valid date when constructing the map. Fixes: 182d679b2298 ("Input: joydev - prevent potential read overflow in ioctl") Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones") Reported-by: Murray McAllister Suggested-by: Linus Torvalds Signed-off-by: Alexander Larkin Link: https://lore.kernel.org/r/20210620120030.1513655-1-avlarkin82@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov (cherry picked from commit f8f84af5da9ee04ef1d271528656dac42a090d00) CVE-2021-3612 Signed-off-by: Thadeu Lima de Souza Cascardo --- drivers/input/joydev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c index 430dc6975004..675fcd0952a2 100644 --- a/drivers/input/joydev.c +++ b/drivers/input/joydev.c @@ -500,7 +500,7 @@ static int joydev_handle_JSIOCSBTNMAP(struct joydev *joydev, memcpy(joydev->keypam, keypam, len); for (i = 0; i < joydev->nkey; i++) - joydev->keymap[keypam[i] - BTN_MISC] = i; + joydev->keymap[joydev->keypam[i] - BTN_MISC] = i; out: kfree(keypam); From patchwork Thu Sep 23 23:51:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1531968 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=DsMSjUTy; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4HFsQh3z0lz9tkD for ; Fri, 24 Sep 2021 09:52:12 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1mTYVZ-0001v5-EH; Thu, 23 Sep 2021 23:52:05 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1mTYVX-0001ti-JI for kernel-team@lists.ubuntu.com; Thu, 23 Sep 2021 23:52:03 +0000 Received: from localhost.localdomain (1.general.cascardo.us.vpn [10.172.70.58]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id B8040412AC for ; Thu, 23 Sep 2021 23:52:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1632441123; bh=MGZhN0MNk4ifZyKk6F6A80yIu756L1wThrhPCftVjCQ=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=DsMSjUTya8LXjA8qMaKXs99EEY7vji7N/jIOfPmQPrhmK/97n86bHWrJ04Xu9rGsq pejYTJXVlNIhnVdnYBPrWUC18gbiEbAOBMYB+eesNKZ7jyzj6Ne12bEBEfzCrkaFZl 32PSOMyNfrgZ6EUZNCPPcXDtG9PMfcX7MZSgv5XeCq341yVdnNbBSRPlHn3JaPjqRt l5pgtAyhaz+4EAZZjzYWKE0b5eZZOdJqEHwJh5M2T5+HMuvTyNsgC5SvoOPHfg7cGZ 9pM/hTP0gz2vuq1MLjCeP0nAqH/SDkhE4/lvXzjzQk9OaAF8tX2H7Msb22TRGFm0n0 gof0W26OEe0og== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU focal/linux-hwe-5.8 3/4] KVM: do not allow mapping valid but non-reference-counted pages Date: Thu, 23 Sep 2021 20:51:00 -0300 Message-Id: <20210923235101.49134-4-cascardo@canonical.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210923235101.49134-1-cascardo@canonical.com> References: <20210923235101.49134-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Nicholas Piggin It's possible to create a region which maps valid but non-refcounted pages (e.g., tail pages of non-compound higher order allocations). These host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family of APIs, which take a reference to the page, which takes it from 0 to 1. When the reference is dropped, this will free the page incorrectly. Fix this by only taking a reference on valid pages if it was non-zero, which indicates it is participating in normal refcounting (and can be released with put_page). This addresses CVE-2021-22543. Signed-off-by: Nicholas Piggin Tested-by: Paolo Bonzini Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini (cherry picked from commit f8be156be163a052a067306417cd0ff679068c97) CVE-2021-22543 Signed-off-by: Thadeu Lima de Souza Cascardo --- virt/kvm/kvm_main.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 938be037949d..ed90810b72fa 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1816,6 +1816,13 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault) return true; } +static int kvm_try_get_pfn(kvm_pfn_t pfn) +{ + if (kvm_is_reserved_pfn(pfn)) + return 1; + return get_page_unless_zero(pfn_to_page(pfn)); +} + static int hva_to_pfn_remapped(struct vm_area_struct *vma, unsigned long addr, bool *async, bool write_fault, bool *writable, @@ -1865,13 +1872,21 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma, * Whoever called remap_pfn_range is also going to call e.g. * unmap_mapping_range before the underlying pages are freed, * causing a call to our MMU notifier. + * + * Certain IO or PFNMAP mappings can be backed with valid + * struct pages, but be allocated without refcounting e.g., + * tail pages of non-compound higher order allocations, which + * would then underflow the refcount when the caller does the + * required put_page. Don't allow those pages here. */ - kvm_get_pfn(pfn); + if (!kvm_try_get_pfn(pfn)) + r = -EFAULT; out: pte_unmap_unlock(ptep, ptl); *p_pfn = pfn; - return 0; + + return r; } /* From patchwork Thu Sep 23 23:51:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1531972 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=J3otCfQk; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4HFsQm1DMdz9t2b for ; Fri, 24 Sep 2021 09:52:16 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1mTYVd-0001xt-Pn; Thu, 23 Sep 2021 23:52:09 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1mTYVY-0001ui-SS for kernel-team@lists.ubuntu.com; Thu, 23 Sep 2021 23:52:04 +0000 Received: from localhost.localdomain (1.general.cascardo.us.vpn [10.172.70.58]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id F2EE7412AC for ; Thu, 23 Sep 2021 23:52:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1632441124; bh=xb7f/LA722a+sZwEWjBiT6eFYS+bGTGAQgF2NsDKk4M=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=J3otCfQkvcPtZE1pxUKoKGL4kGHa0JwMusXig+kQANECgCerDcXMendRtsMkw17+O npNkBjhkzXeoW1q170HFVvVPO2XsjHSuboQLZ1je+QXaAF/RCwuXnuspQTNLdTUU7g 0KLrOVDKiTqp9gWB8WB49GFZ08kJwklZ9iLsUanDbVxwTY16HzVCcjaOqP+eueTs5q s1yAKIo6NzgjWb3Ch65vT8AFmekqm8m5f+59fINl5EUU5Ha17LeDhMoCqZj2Zomg2e 4BS8B5m7ip7Ieaf1Q+g+FTx2aB4nQAG9CpzLLoKsAwg6aMbfNfwALaNF7+QNyN1n76 ZEF/Oto6pLYiQ== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU focal/linux-hwe-5.8 4/4] KVM: SVM: Periodically schedule when unregistering regions on destroy Date: Thu, 23 Sep 2021 20:51:01 -0300 Message-Id: <20210923235101.49134-5-cascardo@canonical.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210923235101.49134-1-cascardo@canonical.com> References: <20210923235101.49134-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: David Rientjes There may be many encrypted regions that need to be unregistered when a SEV VM is destroyed. This can lead to soft lockups. For example, on a host running 4.15: watchdog: BUG: soft lockup - CPU#206 stuck for 11s! [t_virtual_machi:194348] CPU: 206 PID: 194348 Comm: t_virtual_machi RIP: 0010:free_unref_page_list+0x105/0x170 ... Call Trace: [<0>] release_pages+0x159/0x3d0 [<0>] sev_unpin_memory+0x2c/0x50 [kvm_amd] [<0>] __unregister_enc_region_locked+0x2f/0x70 [kvm_amd] [<0>] svm_vm_destroy+0xa9/0x200 [kvm_amd] [<0>] kvm_arch_destroy_vm+0x47/0x200 [<0>] kvm_put_kvm+0x1a8/0x2f0 [<0>] kvm_vm_release+0x25/0x30 [<0>] do_exit+0x335/0xc10 [<0>] do_group_exit+0x3f/0xa0 [<0>] get_signal+0x1bc/0x670 [<0>] do_signal+0x31/0x130 Although the CLFLUSH is no longer issued on every encrypted region to be unregistered, there are no other changes that can prevent soft lockups for very large SEV VMs in the latest kernel. Periodically schedule if necessary. This still holds kvm->lock across the resched, but since this only happens when the VM is destroyed this is assumed to be acceptable. Signed-off-by: David Rientjes Message-Id: Signed-off-by: Paolo Bonzini (cherry picked from commit 7be74942f184fdfba34ddd19a0d995deb34d4a03) CVE-2020-36311 Signed-off-by: Thadeu Lima de Souza Cascardo --- arch/x86/kvm/svm/sev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index fbe7b094491c..cff963543aec 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -1106,6 +1106,7 @@ void sev_vm_destroy(struct kvm *kvm) list_for_each_safe(pos, q, head) { __unregister_enc_region_locked(kvm, list_entry(pos, struct enc_region, list)); + cond_resched(); } }