From patchwork Thu Oct 20 09:30:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Levitsky X-Patchwork-Id: 13012904 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43947C4332F for ; Thu, 20 Oct 2022 09:31:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230264AbiJTJbS (ORCPT ); Thu, 20 Oct 2022 05:31:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56594 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229587AbiJTJbN (ORCPT ); Thu, 20 Oct 2022 05:31:13 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C4CE15381D for ; Thu, 20 Oct 2022 02:31:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1666258268; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HREmpKeE6zG7wXYYBoUdQLZW+Or4137GWbBcA8ju1B4=; b=Gm1Pjx4315vmKUQmwW5w4PZ9x5zXCSKBXSuIMw0TL0Im353kfFkkmCqvHFdLjLZOX4DKRI 0agIiwwretEIKhG0i88xCHoWQ2aUBmUjlISxVYf7p/sMTs0uXWs6UnhEWx5E/cDLQD8/pS EJSW1PRYAVAzwmB/CjZImmQMfHd9pS4= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-653-posLbKhRPH6OIOo4sHzkZw-1; Thu, 20 Oct 2022 05:31:05 -0400 X-MC-Unique: posLbKhRPH6OIOo4sHzkZw-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id A02CD882820; Thu, 20 Oct 2022 09:31:04 +0000 (UTC) Received: from localhost.localdomain (ovpn-192-51.brq.redhat.com [10.40.192.51]) by smtp.corp.redhat.com (Postfix) with ESMTP id 75D0E49BB60; Thu, 20 Oct 2022 09:31:01 +0000 (UTC) From: Maxim Levitsky To: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Paolo Bonzini , Borislav Petkov , Ingo Molnar , Sean Christopherson , x86@kernel.org, Thomas Gleixner , Dave Hansen , "H. Peter Anvin" , Maxim Levitsky Subject: [PATCH 0/4] nSVM: fix L0 crash if L2 has shutdown condtion which L1 doesn't intercept Date: Thu, 20 Oct 2022 12:30:51 +0300 Message-Id: <20221020093055.224317-1-mlevitsk@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org Recently while trying to fix some unit tests I found another CVE in SVM nested code. In 'shutdown_interception' vmexit handler we call kvm_vcpu_reset. However if running nested and L1 doesn't intercept shutdown, we will still end up running this function and trigger a bug in it. The bug is that this function resets the 'vcpu->arch.hflags' without properly leaving the nested state, which leaves the vCPU in inconsistent state, which later triggers a kernel panic in SVM code. The same bug can likely be triggered by sending INIT via local apic to a vCPU which runs a nested guest. On VMX we are lucky that the issue can't happen because VMX always intercepts triple faults, thus triple fault in L2 will always be redirected to L1. Plus the 'handle_triple_fault' of VMX doesn't reset the vCPU. INIT IPI can't happen on VMX either because INIT events are masked while in VMX mode. Best regards, Maxim Levitsky Maxim Levitsky (4): KVM: x86: nSVM: leave nested mode on vCPU free KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in use KVM: x86: add kvm_leave_nested KVM: x86: forcibly leave nested mode on vCPU reset arch/x86/kvm/svm/nested.c | 6 +++--- arch/x86/kvm/svm/svm.c | 1 + arch/x86/kvm/vmx/nested.c | 3 --- arch/x86/kvm/x86.c | 9 ++++++++- 4 files changed, 12 insertions(+), 7 deletions(-)