This is a note to let you know that I've just added the patch titled
KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kvm-x86-inject-gp-if-wrmsr-sets-reserved-bits-in-apic-self-ipi.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From ba5838abb05334e4abfdff1490585c7f365e0424 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@xxxxxxxxxx>
Date: Sat, 7 Jan 2023 01:10:20 +0000
Subject: KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
From: Sean Christopherson <seanjc@xxxxxxxxxx>
commit ba5838abb05334e4abfdff1490585c7f365e0424 upstream.
Inject a #GP if the guest attempts to set reserved bits in the x2APIC-only
Self-IPI register. Bits 7:0 hold the vector, all other bits are reserved.
Reported-by: Marc Orr <marcorr@xxxxxxxxxx>
Cc: Ben Gardon <bgardon@xxxxxxxxxx>
Cc: Venkatesh Srinivas <venkateshs@xxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20230107011025.565472-2-seanjc@xxxxxxxxxx
Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/kvm/lapic.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2127,10 +2127,14 @@ int kvm_lapic_reg_write(struct kvm_lapic
break;
case APIC_SELF_IPI:
- if (apic_x2apic_mode(apic))
- kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0);
- else
+ /*
+ * Self-IPI exists only when x2APIC is enabled. Bits 7:0 hold
+ * the vector, everything else is reserved.
+ */
+ if (!apic_x2apic_mode(apic) || (val & ~APIC_VECTOR_MASK))
ret = 1;
+ else
+ kvm_apic_send_ipi(apic, APIC_DEST_SELF | val, 0);
break;
default:
ret = 1;
Patches currently in stable-queue which might be from seanjc@xxxxxxxxxx are
queue-5.15/kvm-svm-hyper-v-placate-modpost-section-mismatch-error.patch
queue-5.15/x86-virt-force-gif-1-prior-to-disabling-svm-for-reboot-flows.patch
queue-5.15/kvm-x86-inject-gp-if-wrmsr-sets-reserved-bits-in-apic-self-ipi.patch
queue-5.15/x86-reboot-disable-svm-not-just-vmx-when-stopping-cpus.patch
queue-5.15/x86-reboot-disable-virtualization-in-an-emergency-if-svm-is-supported.patch
queue-5.15/x86-crash-disable-virt-in-core-nmi-crash-handler-to-avoid-double-shootdown.patch
queue-5.15/kvm-destroy-target-device-if-coalesced-mmio-unregistration-fails.patch
queue-5.15/kvm-svm-fix-potential-overflow-in-sev-s-send-receive_update_data.patch
