[linux] 01/01: kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (CVE-2016-9588)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Sun Jan 1 08:34:13 UTC 2017
This is an automated email from the git hooks/post-receive script.
carnil pushed a commit to branch sid
in repository linux.
commit 5efdda62b441b731a698bca07bfcdac8392369a1
Author: Salvatore Bonaccorso <carnil at debian.org>
Date: Sun Jan 1 09:12:12 2017 +0100
kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (CVE-2016-9588)
---
debian/changelog | 2 +
...low-L1-to-intercept-software-exceptions-B.patch | 65 ++++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 68 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 92d3c4d..1b985b7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -10,6 +10,8 @@ linux (4.8.15-2) UNRELEASED; urgency=medium
[ Salvatore Bonaccorso ]
* sg_write()/bsg_write() is not fit to be called under KERNEL_DS
(CVE-2016-10088)
+ * kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
+ (CVE-2016-9588)
-- Ben Hutchings <ben at decadent.org.uk> Tue, 27 Dec 2016 09:05:58 +0000
diff --git a/debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch b/debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch
new file mode 100644
index 0000000..906a67c
--- /dev/null
+++ b/debian/patches/bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch
@@ -0,0 +1,65 @@
+From: Jim Mattson <jmattson at google.com>
+Date: Mon, 12 Dec 2016 11:01:37 -0800
+Subject: kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
+Origin: https://git.kernel.org/linus/ef85b67385436ddc1998f45f1d6a210f935b3388
+
+When L2 exits to L0 due to "exception or NMI", software exceptions
+(#BP and #OF) for which L1 has requested an intercept should be
+handled by L1 rather than L0. Previously, only hardware exceptions
+were forwarded to L1.
+
+Signed-off-by: Jim Mattson <jmattson at google.com>
+Cc: stable at vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+---
+ arch/x86/kvm/vmx.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index c41d7ffdda5a..24db5fb6f575 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1389,10 +1389,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
+ return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
+ }
+
+-static inline bool is_exception(u32 intr_info)
++static inline bool is_nmi(u32 intr_info)
+ {
+ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
+- == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
++ == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
+ }
+
+ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+@@ -5728,7 +5728,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
+ if (is_machine_check(intr_info))
+ return handle_machine_check(vcpu);
+
+- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
++ if (is_nmi(intr_info))
+ return 1; /* already handled by vmx_vcpu_run() */
+
+ if (is_no_device(intr_info)) {
+@@ -8170,7 +8170,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
+
+ switch (exit_reason) {
+ case EXIT_REASON_EXCEPTION_NMI:
+- if (!is_exception(intr_info))
++ if (is_nmi(intr_info))
+ return false;
+ else if (is_page_fault(intr_info))
+ return enable_ept;
+@@ -8765,8 +8765,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
+ kvm_machine_check();
+
+ /* We need to handle NMIs before interrupts are enabled */
+- if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
+- (exit_intr_info & INTR_INFO_VALID_MASK)) {
++ if (is_nmi(exit_intr_info)) {
+ kvm_before_handle_nmi(&vmx->vcpu);
+ asm("int $2");
+ kvm_after_handle_nmi(&vmx->vcpu);
+--
+2.11.0
+
diff --git a/debian/patches/series b/debian/patches/series
index a018747..c7ac9b3 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -105,6 +105,7 @@ bugfix/all/mnt-Add-a-per-mount-namespace-limit-on-the-number-of.patch
bugfix/all/net-handle-no-dst-on-skb-in-icmp6_send.patch
bugfix/all/netfilter-ipv6-nf_defrag-drop-mangled-skb-on-ream-er.patch
bugfix/all/sg_write-bsg_write-is-not-fit-to-be-called-under-KER.patch
+bugfix/all/kvm-nVMX-Allow-L1-to-intercept-software-exceptions-B.patch
# ABI maintenance
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list