[linux] 01/03: [x86] kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (CVE-2016-9588)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch jessie-security
in repository linux.

commit b0db7e158a2a2f3e5a01bfa12ed62849b46e0b92
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Tue Mar 7 20:10:57 2017 +0000

    [x86] kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (CVE-2016-9588)
---
 debian/changelog                                   |  5 ++
 ...o-intercept-software-exceptions-bp-and-of.patch | 62 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 68 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 6c83b2d..540e922 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,6 @@
 linux (3.16.39-1+deb8u2) UNRELEASED; urgency=medium
 
+  [ Salvatore Bonaccorso ]
   * ipc/shm: Fix shmat mmap nil-page protection (CVE-2017-5669)
   * sctp: avoid BUG_ON on sctp_wait_for_sndbuf (CVE-2017-5986)
   * sctp: deny peeloff operation on asocs with threads sleeping on it
@@ -11,6 +12,10 @@ linux (3.16.39-1+deb8u2) UNRELEASED; urgency=medium
   * TTY: n_hdlc, fix lockdep false positive
   * tty: n_hdlc: get rid of racy n_hdlc.tbuf (CVE-2017-2636)
 
+  [ Ben Hutchings ]
+  * [x86] kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
+    (CVE-2016-9588)
+
  -- Salvatore Bonaccorso <carnil at debian.org>  Tue, 07 Mar 2017 17:10:30 +0100
 
 linux (3.16.39-1+deb8u1) jessie-security; urgency=high
diff --git a/debian/patches/bugfix/x86/kvm-nvmx-allow-l1-to-intercept-software-exceptions-bp-and-of.patch b/debian/patches/bugfix/x86/kvm-nvmx-allow-l1-to-intercept-software-exceptions-bp-and-of.patch
new file mode 100644
index 0000000..33878e2
--- /dev/null
+++ b/debian/patches/bugfix/x86/kvm-nvmx-allow-l1-to-intercept-software-exceptions-bp-and-of.patch
@@ -0,0 +1,62 @@
+From: Jim Mattson <jmattson at google.com>
+Date: Mon, 12 Dec 2016 11:01:37 -0800
+Subject: kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
+Origin: https://git.kernel.org/linus/ef85b67385436ddc1998f45f1d6a210f935b3388
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2016-9588
+
+When L2 exits to L0 due to "exception or NMI", software exceptions
+(#BP and #OF) for which L1 has requested an intercept should be
+handled by L1 rather than L0. Previously, only hardware exceptions
+were forwarded to L1.
+
+Signed-off-by: Jim Mattson <jmattson at google.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+[bwh: Backported to 3.16: adjust context]
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+---
+ arch/x86/kvm/vmx.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1073,10 +1073,10 @@ static inline int nested_cpu_has_ept(str
+ 	return nested_cpu_has2(vmcs12, SECONDARY_EXEC_ENABLE_EPT);
+ }
+ 
+-static inline bool is_exception(u32 intr_info)
++static inline bool is_nmi(u32 intr_info)
+ {
+ 	return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
+-		== (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
++		== (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
+ }
+ 
+ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+@@ -4831,7 +4831,7 @@ static int handle_exception(struct kvm_v
+ 	if (is_machine_check(intr_info))
+ 		return handle_machine_check(vcpu);
+ 
+-	if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
++	if (is_nmi(intr_info))
+ 		return 1;  /* already handled by vmx_vcpu_run() */
+ 
+ 	if (is_no_device(intr_info)) {
+@@ -6889,7 +6889,7 @@ static bool nested_vmx_exit_handled(stru
+ 
+ 	switch (exit_reason) {
+ 	case EXIT_REASON_EXCEPTION_NMI:
+-		if (!is_exception(intr_info))
++		if (is_nmi(intr_info))
+ 			return 0;
+ 		else if (is_page_fault(intr_info))
+ 			return enable_ept;
+@@ -7186,8 +7186,7 @@ static void vmx_complete_atomic_exit(str
+ 		kvm_machine_check();
+ 
+ 	/* We need to handle NMIs before interrupts are enabled */
+-	if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
+-	    (exit_intr_info & INTR_INFO_VALID_MASK)) {
++	if (is_nmi(exit_intr_info)) {
+ 		kvm_before_handle_nmi(&vmx->vcpu);
+ 		asm("int $2");
+ 		kvm_after_handle_nmi(&vmx->vcpu);
diff --git a/debian/patches/series b/debian/patches/series
index edc5f31..f80c03a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -702,6 +702,7 @@ bugfix/all/net-llc-avoid-BUG_ON-in-skb_orphan.patch
 bugfix/all/packet-fix-races-in-fanout_add.patch
 bugfix/all/TTY-n_hdlc-fix-lockdep-false-positive.patch
 bugfix/all/tty-n_hdlc-get-rid-of-racy-n_hdlc.tbuf.patch
+bugfix/x86/kvm-nvmx-allow-l1-to-intercept-software-exceptions-bp-and-of.patch
 
 # Fix ABI changes
 debian/of-fix-abi-changes.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git