This is a note to let you know that I've just added the patch titled
KVM: x86: nSVM: don't copy virt_ext from vmcb12
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kvm-x86-nsvm-don-t-copy-virt_ext-from-vmcb12.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From faf6b755629627f19feafa75b32e81cd7738f12d Mon Sep 17 00:00:00 2001
From: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
Date: Tue, 14 Sep 2021 18:48:16 +0300
Subject: KVM: x86: nSVM: don't copy virt_ext from vmcb12
From: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
commit faf6b755629627f19feafa75b32e81cd7738f12d upstream.
These field correspond to features that we don't expose yet to L2
While currently there are no CVE worthy features in this field,
if AMD adds more features to this field, that could allow guest
escapes similar to CVE-2021-3653 and CVE-2021-3656.
Signed-off-by: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
Message-Id: <20210914154825.104886-6-mlevitsk@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/kvm/svm/nested.c | 1 -
1 file changed, 1 deletion(-)
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -447,7 +447,6 @@ static void nested_prepare_vmcb_control(
(svm->nested.ctl.int_ctl & int_ctl_vmcb12_bits) |
(svm->nested.hsave->control.int_ctl & int_ctl_vmcb01_bits);
- svm->vmcb->control.virt_ext = svm->nested.ctl.virt_ext;
svm->vmcb->control.int_vector = svm->nested.ctl.int_vector;
svm->vmcb->control.int_state = svm->nested.ctl.int_state;
svm->vmcb->control.event_inj = svm->nested.ctl.event_inj;
Patches currently in stable-queue which might be from mlevitsk@xxxxxxxxxx are
queue-5.10/kvm-x86-nsvm-don-t-copy-virt_ext-from-vmcb12.patch
queue-5.10/kvm-x86-fix-stack-out-of-bounds-memory-access-from-ioapic_write_indirect.patch
