All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
	"Jim Mattson" <jmattson@google.com>,
	"Peter Shier" <pshier@google.com>,
	"Felix Wilhelm" <fwilhelm@google.com>,
	"Paolo Bonzini" <pbonzini@redhat.com>
Subject: [PATCH 3.16 15/16] KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
Date: Fri, 22 Mar 2019 05:20:18 +0000	[thread overview]
Message-ID: <lsq.1553232018.430895167@decadent.org.uk> (raw)
In-Reply-To: <lsq.1553232017.771830163@decadent.org.uk>

3.16.64-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Shier <pshier@google.com>

commit ecec76885bcfe3294685dc363fd1273df0d5d65f upstream.

Bugzilla: 1671904

There are multiple code paths where an hrtimer may have been started to
emulate an L1 VMX preemption timer that can result in a call to free_nested
without an intervening L2 exit where the hrtimer is normally
cancelled. Unconditionally cancel in free_nested to cover all cases.

Embargoed until Feb 7th 2019.

Signed-off-by: Peter Shier <pshier@google.com>
Reported-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Reported-by: Felix Wilhelm <fwilhelm@google.com>
Message-Id: <20181011184646.154065-1-pshier@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.16: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/x86/kvm/vmx.c | 1 +
 1 file changed, 1 insertion(+)

--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6169,6 +6169,7 @@ static void free_nested(struct vcpu_vmx
 {
 	if (!vmx->nested.vmxon)
 		return;
+	hrtimer_cancel(&vmx->nested.preemption_timer);
 	vmx->nested.vmxon = false;
 	if (vmx->nested.current_vmptr != -1ull) {
 		nested_release_vmcs12(vmx);


  parent reply	other threads:[~2019-03-22  5:24 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-22  5:20 [PATCH 3.16 00/16] 3.16.64-rc1 review Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 08/16] HID: debug: fix error handling in hid_debug_events_read() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 07/16] can: gw: ensure DLC boundaries after CAN frame modification Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 09/16] HID: debug: improve hid_debug_event() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 05/16] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data Ben Hutchings
2019-03-22  5:20 ` Ben Hutchings [this message]
2019-03-22  5:20 ` [PATCH 3.16 02/16] mm: cma: fix incorrect type conversion for size during dma allocation Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 14/16] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 11/16] KVM: PPC: Move xics_debugfs_init out of create Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 01/16] xfs: don't BUG() on mixed direct and mapped I/O Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 13/16] KVM: use after free in kvm_ioctl_create_device() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 12/16] KVM: Protect device ops->create and list_add with kvm->lock Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 06/16] net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 10/16] HID: debug: fix the ring buffer implementation Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 03/16] swiotlb: clean up reporting Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 04/16] sunrpc: use-after-free in svc_process_common() Ben Hutchings
2019-03-22  5:20 ` [PATCH 3.16 16/16] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Ben Hutchings
2019-03-22 13:44 ` [PATCH 3.16 00/16] 3.16.64-rc1 review Guenter Roeck
2019-03-23  4:43   ` Guenter Roeck
2019-03-24 23:25     ` Ben Hutchings

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=lsq.1553232018.430895167@decadent.org.uk \
    --to=ben@decadent.org.uk \
    --cc=akpm@linux-foundation.org \
    --cc=fwilhelm@google.com \
    --cc=jmattson@google.com \
    --cc=kda@linux-powerpc.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pbonzini@redhat.com \
    --cc=pshier@google.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.