|
 |
f48d8f |
From 9cb8a03ebca7263af03701ef256248ca8e5c434d Mon Sep 17 00:00:00 2001
|
|
|
f48d8f |
From: Artem Savkov <asavkov@redhat.com>
|
|
|
f48d8f |
Date: Wed, 7 Jul 2021 17:44:40 +0200
|
|
|
f48d8f |
Subject: [PATCH] KVM: do not allow mapping valid but non-reference-counted
|
|
|
f48d8f |
pages
|
|
|
f48d8f |
|
|
|
f48d8f |
Kernels:
|
|
|
f48d8f |
4.18.0-305.el8
|
|
|
f48d8f |
4.18.0-305.3.1.el8_4
|
|
|
f48d8f |
4.18.0-305.7.1.el8_4
|
|
|
f48d8f |
|
|
|
f48d8f |
Changes since last build:
|
|
|
f48d8f |
[x86_64]:
|
|
|
f48d8f |
kvm_main.o: changed function: __gfn_to_pfn_memslot
|
|
|
f48d8f |
|
|
|
f48d8f |
[ppc64le]:
|
|
|
f48d8f |
kvm_main.o: changed function: gfn_to_pfn_memslot
|
|
|
f48d8f |
kvm_main.o: changed function: hva_to_pfn
|
|
|
f48d8f |
|
|
|
f48d8f |
---------------------------
|
|
|
f48d8f |
|
|
|
f48d8f |
Kernels:
|
|
|
f48d8f |
4.18.0-305.el8
|
|
|
f48d8f |
4.18.0-305.3.1.el8_4
|
|
|
f48d8f |
4.18.0-305.7.1.el8_4
|
|
|
f48d8f |
4.18.0-305.10.2.el8_4
|
|
|
f48d8f |
|
|
|
f48d8f |
Modifications: none
|
|
|
f48d8f |
Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-8/-/merge_requests/898
|
|
|
f48d8f |
Testing: kernel_write.c reproducer
|
|
|
f48d8f |
|
|
|
f48d8f |
commit 9871aa051ac11ab8551be01d7394915a5530dbbd
|
|
|
f48d8f |
Author: Jon Maloy <jmaloy@redhat.com>
|
|
|
f48d8f |
Date: Wed Jun 30 21:09:40 2021 -0400
|
|
|
f48d8f |
|
|
|
f48d8f |
KVM: do not allow mapping valid but non-reference-counted pages
|
|
|
f48d8f |
|
|
|
f48d8f |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1975514
|
|
|
f48d8f |
Upstream: commit f8be156be163a052a067306417cd0ff679068c97
|
|
|
f48d8f |
CVE: CVE-2021-22543
|
|
|
f48d8f |
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=37829337
|
|
|
f48d8f |
|
|
|
f48d8f |
commit f8be156be163a052a067306417cd0ff679068c97
|
|
|
f48d8f |
Author: Nicholas Piggin <npiggin@gmail.com>
|
|
|
f48d8f |
Date: Thu Jun 24 08:29:04 2021 -0400
|
|
|
f48d8f |
|
|
|
f48d8f |
KVM: do not allow mapping valid but non-reference-counted pages
|
|
|
f48d8f |
|
|
|
f48d8f |
It's possible to create a region which maps valid but non-refcounted
|
|
|
f48d8f |
pages (e.g., tail pages of non-compound higher order allocations). These
|
|
|
f48d8f |
host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family
|
|
|
f48d8f |
of APIs, which take a reference to the page, which takes it from 0 to 1.
|
|
|
f48d8f |
When the reference is dropped, this will free the page incorrectly.
|
|
|
f48d8f |
|
|
|
f48d8f |
Fix this by only taking a reference on valid pages if it was non-zero,
|
|
|
f48d8f |
which indicates it is participating in normal refcounting (and can be
|
|
|
f48d8f |
released with put_page).
|
|
|
f48d8f |
|
|
|
f48d8f |
This addresses CVE-2021-22543.
|
|
|
f48d8f |
|
|
|
f48d8f |
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
|
|
|
f48d8f |
Tested-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
f48d8f |
Cc: stable@vger.kernel.org
|
|
|
f48d8f |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
f48d8f |
|
|
|
f48d8f |
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
|
f48d8f |
|
|
|
f48d8f |
Signed-off-by: Artem Savkov <asavkov@redhat.com>
|
|
|
f48d8f |
Acked-by: Yannick Cote <ycote@redhat.com>
|
|
|
f48d8f |
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
|
|
|
f48d8f |
---
|
|
|
f48d8f |
virt/kvm/kvm_main.c | 19 +++++++++++++++++--
|
|
|
f48d8f |
1 file changed, 17 insertions(+), 2 deletions(-)
|
|
|
f48d8f |
|
|
|
f48d8f |
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
|
|
f48d8f |
index d4ec73c304a31..9f1cf429954c7 100644
|
|
|
f48d8f |
--- a/virt/kvm/kvm_main.c
|
|
|
f48d8f |
+++ b/virt/kvm/kvm_main.c
|
|
|
f48d8f |
@@ -1894,6 +1894,13 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
|
|
|
f48d8f |
return true;
|
|
|
f48d8f |
}
|
|
|
f48d8f |
|
|
|
f48d8f |
+static int kvm_try_get_pfn(kvm_pfn_t pfn)
|
|
|
f48d8f |
+{
|
|
|
f48d8f |
+ if (kvm_is_reserved_pfn(pfn))
|
|
|
f48d8f |
+ return 1;
|
|
|
f48d8f |
+ return get_page_unless_zero(pfn_to_page(pfn));
|
|
|
f48d8f |
+}
|
|
|
f48d8f |
+
|
|
|
f48d8f |
static int hva_to_pfn_remapped(struct vm_area_struct *vma,
|
|
|
f48d8f |
unsigned long addr, bool *async,
|
|
|
f48d8f |
bool write_fault, bool *writable,
|
|
|
f48d8f |
@@ -1936,11 +1943,19 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
|
|
|
f48d8f |
* Whoever called remap_pfn_range is also going to call e.g.
|
|
|
f48d8f |
* unmap_mapping_range before the underlying pages are freed,
|
|
|
f48d8f |
* causing a call to our MMU notifier.
|
|
|
f48d8f |
+ *
|
|
|
f48d8f |
+ * Certain IO or PFNMAP mappings can be backed with valid
|
|
|
f48d8f |
+ * struct pages, but be allocated without refcounting e.g.,
|
|
|
f48d8f |
+ * tail pages of non-compound higher order allocations, which
|
|
|
f48d8f |
+ * would then underflow the refcount when the caller does the
|
|
|
f48d8f |
+ * required put_page. Don't allow those pages here.
|
|
|
f48d8f |
*/
|
|
|
f48d8f |
- kvm_get_pfn(pfn);
|
|
|
f48d8f |
+ if (!kvm_try_get_pfn(pfn))
|
|
|
f48d8f |
+ r = -EFAULT;
|
|
|
f48d8f |
|
|
|
f48d8f |
*p_pfn = pfn;
|
|
|
f48d8f |
- return 0;
|
|
|
f48d8f |
+
|
|
|
f48d8f |
+ return r;
|
|
|
f48d8f |
}
|
|
|
f48d8f |
|
|
|
f48d8f |
/*
|
|
|
f48d8f |
--
|
|
|
f48d8f |
2.26.3
|
|
|
f48d8f |
|