mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-04 01:49:36 +00:00
Code Issues Releases Wiki Activity
linux-stable/arch
History
Yi Wang 3fa2d74796 KVM: SVM: fix panic on out-of-bounds guest IRQ 
commit a80ced6ea5 upstream.

As guest_irq is coming from KVM_IRQFD API call, it may trigger
crash in svm_update_pi_irte() due to out-of-bounds:

crash> bt
PID: 22218  TASK: ffff951a6ad74980  CPU: 73  COMMAND: "vcpu8"
 #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397
 #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d
 #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d
 #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d
 #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9
 #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51
 #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace
    [exception RIP: svm_update_pi_irte+227]
    RIP: ffffffffc0761b53  RSP: ffffb1ba6707fd08  RFLAGS: 00010086
    RAX: ffffb1ba6707fd78  RBX: ffffb1ba66d91000  RCX: 0000000000000001
    RDX: 00003c803f63f1c0  RSI: 000000000000019a  RDI: ffffb1ba66db2ab8
    RBP: 000000000000019a   R8: 0000000000000040   R9: ffff94ca41b82200
    R10: ffffffffffffffcf  R11: 0000000000000001  R12: 0000000000000001
    R13: 0000000000000001  R14: ffffffffffffffcf  R15: 000000000000005f
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm]
 #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm]
 #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm]
    RIP: 00007f143c36488b  RSP: 00007f143a4e04b8  RFLAGS: 00000246
    RAX: ffffffffffffffda  RBX: 00007f05780041d0  RCX: 00007f143c36488b
    RDX: 00007f05780041d0  RSI: 000000004008ae6a  RDI: 0000000000000020
    RBP: 00000000000004e8   R8: 0000000000000008   R9: 00007f05780041e0
    R10: 00007f0578004560  R11: 0000000000000246  R12: 00000000000004e0
    R13: 000000000000001a  R14: 00007f1424001c60  R15: 00007f0578003bc0
    ORIG_RAX: 0000000000000010  CS: 0033  SS: 002b

Vmx have been fix this in commit 3a8b0677fc (KVM: VMX: Do not BUG() on
out-of-bounds guest IRQ), so we can just copy source from that to fix
this.

Co-developed-by: Yi Liu <liu.yi24@zte.com.cn>
Signed-off-by: Yi Liu <liu.yi24@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Message-Id: <20220309113025.44469-1-wang.yi59@zte.com.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-08 14:24:07 +02:00
..
alpha alpha: enable GENERIC_PCI_IOMAP unconditionally 2021-09-19 10:37:00 -07:00
arc uaccess: fix type mismatch warnings from access_ok() 2022-04-08 14:24:01 +02:00
arm ARM: mmp: Fix failure to remove sram device 2022-04-08 14:24:02 +02:00
arm64 arm64: defconfig: build imx-sdma as a module 2022-04-08 14:24:00 +02:00
csky uaccess: fix type mismatch warnings from access_ok() 2022-04-08 14:24:01 +02:00
h8300 Merge branch 'akpm' (patches from Andrew) 2021-09-08 12:55:35 -07:00
hexagon uaccess: fix integer overflow on access_ok() 2022-03-28 09:58:45 +02:00
ia64 PCI/sysfs: Find shadow ROM before static attribute initialization 2022-02-01 17:27:05 +01:00
m68k m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined 2022-04-08 14:23:20 +02:00
microblaze uaccess: fix nios2 and microblaze get_user_8() 2022-04-08 14:23:18 +02:00
mips MIPS: pgalloc: fix memory leak caused by pgd_free() 2022-04-08 14:23:39 +02:00
nds32 nds32: fix access_ok() checks in get/put_user 2022-03-28 09:58:46 +02:00
nios2 uaccess: fix type mismatch warnings from access_ok() 2022-04-08 14:24:01 +02:00
openrisc openrisc: Add clone3 ABI wrapper 2022-01-27 11:04:10 +01:00
parisc parisc: Fix handling off probe non-access faults 2022-04-08 14:23:56 +02:00
powerpc powerpc: Fix build errors with newer binutils 2022-04-08 14:24:04 +02:00
riscv uaccess: fix type mismatch warnings from access_ok() 2022-04-08 14:24:01 +02:00
s390 s390/extable: fix exception table sorting 2022-03-08 19:12:48 +01:00
sh Documentation, arch: Remove leftovers from CIFS_WEAK_PW_HASH 2022-01-27 11:05:21 +01:00
sparc uaccess: fix type mismatch warnings from access_ok() 2022-04-08 14:24:01 +02:00
um block: drop unused includes in <linux/genhd.h> 2022-03-16 14:23:46 +01:00
x86 KVM: SVM: fix panic on out-of-bounds guest IRQ 2022-04-08 14:24:07 +02:00
xtensa xtensa: fix xtensa_wsr always writing 0 2022-04-08 14:23:03 +02:00
.gitignore
Kconfig stack: Constrain and fix stack offset randomization with Clang builds 2022-04-08 14:23:06 +02:00