Re: [PATCH v2 4/9] KVM: x86: forcibly leave nested mode on vCPU reset

From: Liam Merwick <liam.merwick@oracle.com>
To: Maxim Levitsky <mlevitsk@redhat.com>, kvm@vger.kernel.org
Cc: Paolo Bonzini <pbonzini@redhat.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	linux-kernel@vger.kernel.org,
	Chenyi Qiang <chenyi.qiang@intel.com>,
	Yang Zhong <yang.zhong@intel.com>,
	x86@kernel.org, Shuah Khan <shuah@kernel.org>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	"H. Peter Anvin" <hpa@zytor.com>,
	Colton Lewis <coltonlewis@google.com>,
	Borislav Petkov <bp@alien8.de>, Peter Xu <peterx@redhat.com>,
	Sean Christopherson <seanjc@google.com>,
	Jim Mattson <jmattson@google.com>,
	linux-kselftest@vger.kernel.org, Ingo Molnar <mingo@redhat.com>,
	Wei Wang <wei.w.wang@intel.com>,
	David Matlack <dmatlack@google.com>,
	stable@vger.kernel.org, Liam Merwick <liam.merwick@oracle.com>
Subject: Re: [PATCH v2 4/9] KVM: x86: forcibly leave nested mode on vCPU reset
Date: Mon, 21 Nov 2022 16:31:55 +0000	[thread overview]
Message-ID: <d908d6f4-bf73-27d0-e062-19eeee874f3b@oracle.com> (raw)
In-Reply-To: <20221103141351.50662-5-mlevitsk@redhat.com>

On 03/11/2022 14:13, Maxim Levitsky wrote:
> While not obivous, kvm_vcpu_reset() leaves the nested mode by clearing
> 'vcpu->arch.hflags' but it does so without all the required housekeeping.
> 
> On SVM,	it is possible to have a vCPU reset while in guest mode because
> unlike VMX, on SVM, INIT's are not latched in SVM non root mode and in
> addition to that L1 doesn't have to intercept triple fault, which should
> also trigger L1's reset if happens in L2 while L1 didn't intercept it.
> 
> If one of the above conditions happen, KVM will	continue to use vmcb02
> while not having in the guest mode.

"having" is the wrong word here - maybe "not having in the" -> "not 
being in" ?

> 
> Later the IA32_EFER will be cleared which will lead to freeing of the
> nested guest state which will (correctly) free the vmcb02, but since
> KVM still uses it (incorrectly) this will lead to a use after free
> and kernel crash.
> 
> This issue is assigned CVE-2022-3344
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>

Reviewed-by: Liam Merwick <liam.merwick@oracle.com>

> ---
>   arch/x86/kvm/x86.c | 10 ++++++++++
>   1 file changed, 10 insertions(+)
> 
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 316ab1d5317f92..3fd900504e683b 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -11694,8 +11694,18 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
>   	WARN_ON_ONCE(!init_event &&
>   		     (old_cr0 || kvm_read_cr3(vcpu) || kvm_read_cr4(vcpu)));
>   
> +	/*
> +	 * SVM doesn't unconditionally VM-Exit on INIT and SHUTDOWN, thus it's
> +	 * possible to INIT the vCPU while L2 is active.  Force the vCPU back
> +	 * into L1 as EFER.SVME is cleared on INIT (along with all other EFER
> +	 * bits), i.e. virtualization is disabled.
> +	 */
> +	if (is_guest_mode(vcpu))
> +		kvm_leave_nested(vcpu);
> +
>   	kvm_lapic_reset(vcpu, init_event);
>   
> +	WARN_ON_ONCE(is_guest_mode(vcpu) || is_smm(vcpu));
>   	vcpu->arch.hflags = 0;
>   
>   	vcpu->arch.smi_pending = 0;