From: Michael Ellerman <mpe@ellerman.id.au>
To: oss-security@lists.openwall.com
Cc: linuxppc-dev@lists.ozlabs.org
Subject: Linux kernel: powerpc: KVM guest can trigger host crash on Power8
Date: Mon, 25 Oct 2021 22:18:54 +1100 [thread overview]
Message-ID: <87pmrtbbdt.fsf@mpe.ellerman.id.au> (raw)
The Linux kernel for powerpc since v5.2 has a bug which allows a
malicious KVM guest to crash the host, when the host is running on
Power8.
Only machines using Linux as the hypervisor, aka. KVM, powernv or bare
metal, are affected by the bug. Machines running PowerVM are not
affected.
The bug was introduced in:
10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C")
Which was first released in v5.2.
The upstream fix is:
cdeb5d7d890e ("KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest")
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
Which will be included in the v5.16 release.
Note to backporters, the following commits are required:
73287caa9210ded6066833195f4335f7f688a46b
("powerpc64/idle: Fix SP offsets when saving GPRs")
9b4416c5095c20e110c82ae602c254099b83b72f
("KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()")
cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
("KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest")
496c5fe25c377ddb7815c4ce8ecfb676f051e9b6
("powerpc/idle: Don't corrupt back chain when going idle")
I have a test case to trigger the bug, which I can share privately with
anyone who would like to test the fix.
cheers
next reply other threads:[~2021-10-25 11:19 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-25 11:18 Michael Ellerman [this message]
2021-10-26 8:48 ` Linux kernel: powerpc: KVM guest can trigger host crash on Power8 John Paul Adrian Glaubitz
2021-10-27 5:29 ` Nicholas Piggin
2021-10-27 5:30 ` Michael Ellerman
2021-10-27 10:03 ` John Paul Adrian Glaubitz
2021-10-27 11:06 ` Michael Ellerman
2021-10-27 11:09 ` John Paul Adrian Glaubitz
2021-10-28 6:39 ` Michael Ellerman
2021-10-28 11:20 ` John Paul Adrian Glaubitz
2021-10-28 14:05 ` John Paul Adrian Glaubitz
2021-10-28 14:15 ` John Paul Adrian Glaubitz
2021-11-01 17:36 ` Michal Suchánek
2021-10-29 0:41 ` Nicholas Piggin
2021-10-29 12:33 ` John Paul Adrian Glaubitz
2021-11-01 17:43 ` Michal Suchánek
2021-10-30 7:19 ` John Paul Adrian Glaubitz
2021-11-01 6:53 ` Michael Ellerman
2021-11-01 7:37 ` John Paul Adrian Glaubitz
2021-11-01 17:20 ` John Paul Adrian Glaubitz
2022-01-04 13:00 ` John Paul Adrian Glaubitz
2022-01-06 10:58 ` Michael Ellerman
2022-01-07 11:20 ` John Paul Adrian Glaubitz
2022-01-09 22:17 ` John Paul Adrian Glaubitz
2022-01-13 0:17 ` John Paul Adrian Glaubitz
2022-01-26 20:21 ` John Paul Adrian Glaubitz
2022-01-27 15:50 ` Mike
2021-10-28 13:52 ` John Paul Adrian Glaubitz
2021-10-28 14:00 ` John Paul Adrian Glaubitz
2021-10-28 3:58 ` [oss-security] " Salvatore Bonaccorso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87pmrtbbdt.fsf@mpe.ellerman.id.au \
--to=mpe@ellerman.id.au \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=oss-security@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).