Received: by 10.223.185.116 with SMTP id b49csp6378147wrg; Wed, 28 Feb 2018 08:25:53 -0800 (PST) X-Google-Smtp-Source: AH8x225i1iY56fOKvfOj2hOxtQEp/c6WmnHrsdodZWHLdgE3GRuWRIPMUsHlTGr7QYpEael5JzDX X-Received: by 10.98.134.10 with SMTP id x10mr18299456pfd.78.1519835153815; Wed, 28 Feb 2018 08:25:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519835153; cv=none; d=google.com; s=arc-20160816; b=ePhlWA0H03fXUO7iIxARSHT3B/JlUGK3an8JgniVBIcItMmtxcTg1gBrD/zpGQOP0i mgn5KFDpiN1l5iHtV30SzFiaK+3WKclfmSb6JyCLg7frv9TRf+H+RUP307R4VniCZE0l /88Yf/9fSm05ERqNKcIvEsSrLfHbq8Y9wMPawif05Db0xfSPSc5nl9+qonQa4JSyeMXN tR8hDwUe9IZv07ZfXa+m+W/L5TXJR8WG/9v9rYoyLf6CWbTEn/955e/eT81tJDoNy8Ts r2+VLDe6NbUzHNVRxK7pZ3utEVifvM8kGZOrmRayeccWHSBWOjyqyJglXkhp0dulaSg2 j4SQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=Bf/szv837tqWIPmS05v813WagDe8/xtJ7hhs8SbHbF0=; b=CIw8U2h9SXeB5B9F6YcC56e6gK5F4+Q4nDYjtoUQSiyZ1kV2pFpWWk99Rt4vyE8t0L EEuGv1OMgHEKyNu9gPCgXSOxdLZTFEDJ2gIxyZDYHkeZEqV2FpD59f+BF7Vs3dlpIcZ2 TkjqMqUnPIpDTkmWctW+9yRoBYEkBj2V+5+ZJ3F6DD931xv1vdMm93vbufppf5Cufu+X AH12oRQdsXtFX3zVv5/ngedNWo25LvewjEPiGBqUfwkZyaUULzmnAmCaHR0nBjfvwUvR iFQrWWheST2MxqtrSnYzAvpKrMHRuPIRn8o0NFWXoSf1rkfYKWaHiQRB0hwziGb9xxvE m6jw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 68si1370271pff.141.2018.02.28.08.25.39; Wed, 28 Feb 2018 08:25:53 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935149AbeB1QUb (ORCPT + 99 others); Wed, 28 Feb 2018 11:20:31 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:35347 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935024AbeB1QU0 (ORCPT ); Wed, 28 Feb 2018 11:20:26 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Yp-0006Xm-68; Wed, 28 Feb 2018 15:22:27 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yk-0000Gu-2Y; Wed, 28 Feb 2018 15:22:22 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Dmitry Vyukov" , "Jim Mattson" , "Paolo Bonzini" , "Radim =?UTF-8?Q?Kr=C4=8Dm=C3=A1=C5=99?=" , "Lan Tianyu" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 212/254] KVM/x86: Check input paging mode when cs.l is set In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Lan Tianyu commit f29810335965ac1f7bcb501ee2af5f039f792416 upstream. Reported by syzkaller: WARNING: CPU: 0 PID: 27962 at arch/x86/kvm/emulate.c:5631 x86_emulate_insn+0x557/0x15f0 [kvm] Modules linked in: kvm_intel kvm [last unloaded: kvm] CPU: 0 PID: 27962 Comm: syz-executor Tainted: G B W 4.15.0-rc2-next-20171208+ #32 Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.01.03.0006.040720161253 04/07/2016 RIP: 0010:x86_emulate_insn+0x557/0x15f0 [kvm] RSP: 0018:ffff8807234476d0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88072d0237a0 RCX: ffffffffa0065c4d RDX: 1ffff100e5a046f9 RSI: 0000000000000003 RDI: ffff88072d0237c8 RBP: ffff880723447728 R08: ffff88072d020000 R09: ffffffffa008d240 R10: 0000000000000002 R11: ffffed00e7d87db3 R12: ffff88072d0237c8 R13: ffff88072d023870 R14: ffff88072d0238c2 R15: ffffffffa008d080 FS: 00007f8a68666700(0000) GS:ffff880802200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002009506c CR3: 000000071fec4005 CR4: 00000000003626f0 Call Trace: x86_emulate_instruction+0x3bc/0xb70 [kvm] ? reexecute_instruction.part.162+0x130/0x130 [kvm] vmx_handle_exit+0x46d/0x14f0 [kvm_intel] ? trace_event_raw_event_kvm_entry+0xe7/0x150 [kvm] ? handle_vmfunc+0x2f0/0x2f0 [kvm_intel] ? wait_lapic_expire+0x25/0x270 [kvm] vcpu_enter_guest+0x720/0x1ef0 [kvm] ... When CS.L is set, vcpu should run in the 64 bit paging mode. Current kvm set_sregs function doesn't have such check when userspace inputs sreg values. This will lead unexpected behavior. This patch is to add checks for CS.L, EFER.LME, EFER.LMA and CR4.PAE when get SREG inputs from userspace in order to avoid unexpected behavior. Suggested-by: Paolo Bonzini Reported-by: Dmitry Vyukov Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Dmitry Vyukov Cc: Jim Mattson Signed-off-by: Tianyu Lan Signed-off-by: Paolo Bonzini [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings --- arch/x86/kvm/x86.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -6579,6 +6579,29 @@ int kvm_task_switch(struct kvm_vcpu *vcp } EXPORT_SYMBOL_GPL(kvm_task_switch); +int kvm_valid_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs) +{ + if ((sregs->efer & EFER_LME) && (sregs->cr0 & X86_CR0_PG_BIT)) { + /* + * When EFER.LME and CR0.PG are set, the processor is in + * 64-bit mode (though maybe in a 32-bit code segment). + * CR4.PAE and EFER.LMA must be set. + */ + if (!(sregs->cr4 & X86_CR4_PAE_BIT) + || !(sregs->efer & EFER_LMA)) + return -EINVAL; + } else { + /* + * Not in 64-bit mode: EFER.LMA is clear and the code + * segment cannot be 64-bit. + */ + if (sregs->efer & EFER_LMA || sregs->cs.l) + return -EINVAL; + } + + return 0; +} + int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs) { @@ -6590,6 +6613,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct if (!guest_cpuid_has_xsave(vcpu) && (sregs->cr4 & X86_CR4_OSXSAVE)) return -EINVAL; + if (kvm_valid_sregs(vcpu, sregs)) + return -EINVAL; + dt.size = sregs->idt.limit; dt.address = sregs->idt.base; kvm_x86_ops->set_idt(vcpu, &dt);