The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@xxxxxxxxxxxxxxx>.
Possible dependencies:
16ae56d7e052 ("KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in use")
2fcf4876ada8 ("KVM: nSVM: implement on demand allocation of the nested state")
72f211ecaa80 ("KVM: x86: allow kvm_x86_ops.set_efer to return an error value")
fd6fa73d1337 ("KVM: x86: SVM: Prevent MSR passthrough when MSR access is denied")
476c9bd8e997 ("KVM: x86: Prepare MSR bitmaps for userspace tracked MSRs")
d85a8034c016 ("KVM: VMX: Rename "find_msr_entry" to "vmx_find_uret_msr"")
eb3db1b13788 ("KVM: VMX: Rename the "shared_msr_entry" struct to "vmx_uret_msr"")
ce833b2324ba ("KVM: VMX: Prepend "MAX_" to MSR array size defines")
7e34fbd05c63 ("KVM: x86: Rename "shared_msrs" to "user_return_msrs"")
8d22b90e942c ("KVM: SVM: refactor exit labels in svm_create_vcpu")
0681de1b8369 ("KVM: SVM: use __GFP_ZERO instead of clear_page")
f4c847a95654 ("KVM: SVM: refactor msr permission bitmap allocation")
0dd16b5b0c9b ("KVM: nSVM: rename nested vmcb to vmcb12")
1feaba144cd3 ("KVM: SVM: rename a variable in the svm_create_vcpu")
bf3c0e5e7102 ("Merge branch 'x86-seves-for-paolo' of https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into HEAD")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 16ae56d7e0528559bf8dc9070e3bfd8ba3de80df Mon Sep 17 00:00:00 2001
From: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
Date: Thu, 3 Nov 2022 16:13:44 +0200
Subject: [PATCH] KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02
while still in use
Make sure that KVM uses vmcb01 before freeing nested state, and warn if
that is not the case.
This is a minimal fix for CVE-2022-3344 making the kernel print a warning
instead of a kernel panic.
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
Message-Id: <20221103141351.50662-3-mlevitsk@xxxxxxxxxx>
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index 4c620999d230..b02a3a1792f1 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1125,6 +1125,9 @@ void svm_free_nested(struct vcpu_svm *svm)
if (!svm->nested.initialized)
return;
+ if (WARN_ON_ONCE(svm->vmcb != svm->vmcb01.ptr))
+ svm_switch_vmcb(svm, &svm->vmcb01);
+
svm_vcpu_free_msrpm(svm->nested.msrpm);
svm->nested.msrpm = NULL;
