This is a note to let you know that I've just added the patch titled
x86/sev: Disable MMIO emulation from user mode
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
x86-sev-disable-mmio-emulation-from-user-mode.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 479772d1158852575c27697588815b6c34abaed9 Mon Sep 17 00:00:00 2001
From: "Borislav Petkov (AMD)" <bp@xxxxxxxxx>
Date: Thu, 5 Oct 2023 11:06:36 +0200
Subject: x86/sev: Disable MMIO emulation from user mode
From: "Borislav Petkov (AMD)" <bp@xxxxxxxxx>
Upstream commit: a37cd2a59d0cb270b1bba568fd3a3b8668b9d3ba
A virt scenario can be constructed where MMIO memory can be user memory.
When that happens, a race condition opens between when the hardware
raises the #VC and when the #VC handler gets to emulate the instruction.
If the MOVS is replaced with a MOVS accessing kernel memory in that
small race window, then write to kernel memory happens as the access
checks are not done at emulation time.
Disable MMIO emulation in user mode temporarily until a sensible use
case appears and justifies properly handling the race window.
Fixes: 0118b604c2c9 ("x86/sev-es: Handle MMIO String Instructions")
Reported-by: Tom Dohrmann <erbse.13@xxxxxx>
Signed-off-by: Borislav Petkov (AMD) <bp@xxxxxxxxx>
Tested-by: Tom Dohrmann <erbse.13@xxxxxx>
Cc: <stable@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/kernel/sev.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/kernel/sev.c
+++ b/arch/x86/kernel/sev.c
@@ -1004,6 +1004,9 @@ static enum es_result vc_handle_mmio(str
enum es_result ret;
long *reg_data;
+ if (user_mode(ctxt->regs))
+ return ES_UNSUPPORTED;
+
switch (insn->opcode.bytes[0]) {
/* MMIO Write */
case 0x88:
Patches currently in stable-queue which might be from bp@xxxxxxxxx are
queue-5.15/x86-sev-check-iobm-for-ioio-exceptions-from-user-space.patch
queue-5.15/x86-sev-check-for-user-space-ioio-pointing-to-kernel-space.patch
queue-5.15/x86-sev-disable-mmio-emulation-from-user-mode.patch
