Commit fe08e36b authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

Merge branch 'kvm-dwmw2-fixes' into HEAD 



This brings in a few important fixes for Xen emulation.
While nobody should be enabling it, the bug effectively
allows userspace to read arbitrary memory.

Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parents 47b0c2e4 8332f0ed

arch/x86/kvm/xen.c

+23 −9
Original line number Diff line number Diff line
@@ -954,6 +954,14 @@ static int kvm_xen_hypercall_complete_userspace(struct kvm_vcpu *vcpu) 
	return kvm_xen_hypercall_set_result(vcpu, run->xen.u.hcall.result);

}



static inline int max_evtchn_port(struct kvm *kvm)

{

	if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode)

		return EVTCHN_2L_NR_CHANNELS;

	else

		return COMPAT_EVTCHN_2L_NR_CHANNELS;

}



static bool wait_pending_event(struct kvm_vcpu *vcpu, int nr_ports,

			       evtchn_port_t *ports)

{
@@ -1042,6 +1050,10 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, 
			*r = -EFAULT;

			goto out;

		}

		if (ports[i] >= max_evtchn_port(vcpu->kvm)) {

			*r = -EINVAL;

			goto out;

		}

	}



	if (sched_poll.nr_ports == 1)
@@ -1215,6 +1227,7 @@ int kvm_xen_hypercall(struct kvm_vcpu *vcpu) 
	bool longmode;

	u64 input, params[6], r = -ENOSYS;

	bool handled = false;

	u8 cpl;



	input = (u64)kvm_register_read(vcpu, VCPU_REGS_RAX);
@@ -1242,9 +1255,17 @@ int kvm_xen_hypercall(struct kvm_vcpu *vcpu) 
		params[5] = (u64)kvm_r9_read(vcpu);

	}

#endif

	cpl = static_call(kvm_x86_get_cpl)(vcpu);

	trace_kvm_xen_hypercall(input, params[0], params[1], params[2],

				params[3], params[4], params[5]);



	/*

	 * Only allow hypercall acceleration for CPL0. The rare hypercalls that

	 * are permitted in guest userspace can be handled by the VMM.

	 */

	if (unlikely(cpl > 0))

		goto handle_in_userspace;



	switch (input) {

	case __HYPERVISOR_xen_version:

		if (params[0] == XENVER_version && vcpu->kvm->arch.xen.xen_version) {
@@ -1279,10 +1300,11 @@ int kvm_xen_hypercall(struct kvm_vcpu *vcpu) 
	if (handled)

		return kvm_xen_hypercall_set_result(vcpu, r);



handle_in_userspace:

	vcpu->run->exit_reason = KVM_EXIT_XEN;

	vcpu->run->xen.type = KVM_EXIT_XEN_HCALL;

	vcpu->run->xen.u.hcall.longmode = longmode;

	vcpu->run->xen.u.hcall.cpl = static_call(kvm_x86_get_cpl)(vcpu);

	vcpu->run->xen.u.hcall.cpl = cpl;

	vcpu->run->xen.u.hcall.input = input;

	vcpu->run->xen.u.hcall.params[0] = params[0];

	vcpu->run->xen.u.hcall.params[1] = params[1];
@@ -1297,14 +1319,6 @@ int kvm_xen_hypercall(struct kvm_vcpu *vcpu) 
	return 0;

}



static inline int max_evtchn_port(struct kvm *kvm)

{

	if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode)

		return EVTCHN_2L_NR_CHANNELS;

	else

		return COMPAT_EVTCHN_2L_NR_CHANNELS;

}



static void kvm_xen_check_poller(struct kvm_vcpu *vcpu, int port)

{

	int poll_evtchn = vcpu->arch.xen.poll_evtchn;

virt/kvm/pfncache.c

+6 −1
Original line number Diff line number Diff line
@@ -297,7 +297,12 @@ int kvm_gfn_to_pfn_cache_refresh(struct kvm *kvm, struct gfn_to_pfn_cache *gpc, 
	if (!gpc->valid || old_uhva != gpc->uhva) {

		ret = hva_to_pfn_retry(kvm, gpc);

	} else {

		/* If the HVA→PFN mapping was already valid, don't unmap it. */

		/*

		 * If the HVA→PFN mapping was already valid, don't unmap it.

		 * But do update gpc->khva because the offset within the page

		 * may have changed.

		 */

		gpc->khva = old_khva + page_offset;

		old_pfn = KVM_PFN_ERR_FAULT;

		old_khva = NULL;

		ret = 0;