From 0fb64a2ea0de74f0e9619b257e3a0c0e90a4b632 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Apr 15 2016 15:27:30 +0000 Subject: CVE-2016-3961 xen: hugetlbfs use may crash PV guests (rhbz 1327219 1323956) --- diff --git a/kernel.spec b/kernel.spec index 8845601..607160c 100644 --- a/kernel.spec +++ b/kernel.spec @@ -614,6 +614,9 @@ Patch683: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch #CVE-2016-2187 rhbz 1317017 1317010 Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch +# CVE-2016-3961 rhbz 1327219 1323956 +Patch699: x86-xen-suppress-hugetlbfs-in-PV-guests.patch + # END OF PATCH DEFINITIONS %endif @@ -2139,6 +2142,9 @@ fi # # %changelog +* Fri Apr 15 2016 Josh Boyer +- CVE-2016-3961 xen: hugetlbfs use may crash PV guests (rhbz 1327219 1323956) + * Fri Apr 15 2016 Josh Boyer - 4.6.0-0.rc3.git2.1 - Linux v4.6-rc3-99-g806fdcce017d diff --git a/x86-xen-suppress-hugetlbfs-in-PV-guests.patch b/x86-xen-suppress-hugetlbfs-in-PV-guests.patch new file mode 100644 index 0000000..1b7c8f2 --- /dev/null +++ b/x86-xen-suppress-hugetlbfs-in-PV-guests.patch @@ -0,0 +1,70 @@ +From 72c339e0c6d9969e664c2cf63e162753d7d859ae Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Thu, 14 Apr 2016 13:03:47 +0000 +Subject: [PATCH] x86/xen: suppress hugetlbfs in PV guests + +Huge pages are not normally available to PV guests. Not suppressing +hugetlbfs use results in an endless loop of page faults when user mode +code tries to access a hugetlbfs mapped area (since the hypervisor +denies such PTEs to be created, but error indications can't be +propagated out of xen_set_pte_at(), just like for various of its +siblings), and - once killed in an oops like this: + +kernel BUG at .../fs/hugetlbfs/inode.c:428! +invalid opcode: 0000 [#1] SMP +Modules linked in: ... +Supported: Yes +CPU: 2 PID: 6088 Comm: hugetlbfs Tainted: G W 4.4.0-2016-01-20-pv #2 +Hardware name: ... +task: ffff8808059205c0 ti: ffff880803c84000 task.ti: ffff880803c84000 +RIP: e030:[] [] remove_inode_hugepages+0x25b/0x320 +RSP: e02b:ffff880803c879a8 EFLAGS: 00010202 +RAX: 000000000077a4db RBX: ffffea001acff000 RCX: 0000000078417d38 +RDX: 0000000000000000 RSI: 000000007e154fa7 RDI: ffff880805d70960 +RBP: 0000000000000960 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 +R13: ffff880807486018 R14: 0000000000000000 R15: ffff880803c87af0 +FS: 00007f85fa8b8700(0000) GS:ffff88080b640000(0000) knlGS:0000000000000000 +CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b +CR2: 00007f85fa000000 CR3: 0000000001a0a000 CR4: 0000000000040660 +Stack: + ffff880000000fb0 ffff880803c87a18 ffff880803c87ae8 ffff8808059205c0 + ffff880803c87af0 ffff880803c87ae8 ffff880807486018 0000000000000000 + ffffffff81bf6e60 ffff880807486168 000003ffffffffff 0000000003c87758 +Call Trace: + [] hugetlbfs_evict_inode+0x15/0x40 + [] evict+0xbd/0x1b0 + [] __dentry_kill+0x19a/0x1f0 + [] dput+0x1fe/0x220 + [] __fput+0x155/0x200 + [] task_work_run+0x60/0xa0 + [] do_exit+0x160/0x400 + [] do_group_exit+0x3b/0xa0 + [] get_signal+0x1ed/0x470 + [] do_signal+0x14/0x110 + [] prepare_exit_to_usermode+0xe9/0xf0 + [] retint_user+0x8/0x13 + +This is XSA-174. + +Signed-off-by: Jan Beulich +Cc: stable@vger.kernel.org +--- + arch/x86/include/asm/hugetlb.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h +index f8a29d2c97b0..e6a8613fbfb0 100644 +--- a/arch/x86/include/asm/hugetlb.h ++++ b/arch/x86/include/asm/hugetlb.h +@@ -4,6 +4,7 @@ + #include + #include + ++#define hugepages_supported() cpu_has_pse + + static inline int is_hugepage_only_range(struct mm_struct *mm, + unsigned long addr, +-- +2.5.5 +