From c2bce50a1b4034c6ecebd7b1623eebf0da4d88fd Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Jan 06 2014 19:20:58 +0000 Subject: Fix use after free crash in KVM (rhbz 1047892) --- diff --git a/KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch b/KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch new file mode 100644 index 0000000..5867231 --- /dev/null +++ b/KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch @@ -0,0 +1,88 @@ +Bugzilla: 1047892 +Upstream-status: Submitted for 3.14 + +Path: news.gmane.org!not-for-mail +From: Marcelo Tosatti +Newsgroups: gmane.comp.emulators.kvm.devel +Subject: KVM: VMX: fix use after free of vmx->loaded_vmcs +Date: Fri, 3 Jan 2014 17:00:51 -0200 +Lines: 31 +Approved: news@gmane.org +Message-ID: <20140103190051.GA16151@amt.cnet> +NNTP-Posting-Host: plane.gmane.org +Mime-Version: 1.0 +Content-Type: text/plain; charset=us-ascii +X-Trace: ger.gmane.org 1388775805 10008 80.91.229.3 (3 Jan 2014 19:03:25 GMT) +X-Complaints-To: usenet@ger.gmane.org +NNTP-Posting-Date: Fri, 3 Jan 2014 19:03:25 +0000 (UTC) +Cc: Jan Kiszka , Paolo Bonzini +To: kvm-devel +Original-X-From: kvm-owner@vger.kernel.org Fri Jan 03 20:03:30 2014 +Return-path: +Envelope-to: gcekd-kvm-devel@plane.gmane.org +Original-Received: from vger.kernel.org ([209.132.180.67]) + by plane.gmane.org with esmtp (Exim 4.69) + (envelope-from ) + id 1VzA1p-0000BI-F0 + for gcekd-kvm-devel@plane.gmane.org; Fri, 03 Jan 2014 20:03:29 +0100 +Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand + id S1752819AbaACTDZ (ORCPT ); + Fri, 3 Jan 2014 14:03:25 -0500 +Original-Received: from mx1.redhat.com ([209.132.183.28]:26936 "EHLO mx1.redhat.com" + rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP + id S1751681AbaACTDY (ORCPT ); + Fri, 3 Jan 2014 14:03:24 -0500 +Original-Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) + by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s03J3NIr007205 + (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); + Fri, 3 Jan 2014 14:03:24 -0500 +Original-Received: from amt.cnet (vpn1-4-118.gru2.redhat.com [10.97.4.118]) + by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id s03J3Mxl004396; + Fri, 3 Jan 2014 14:03:23 -0500 +Original-Received: from amt.cnet (localhost [127.0.0.1]) + by amt.cnet (Postfix) with ESMTP id 98901104ADF; + Fri, 3 Jan 2014 17:00:53 -0200 (BRST) +Original-Received: (from marcelo@localhost) + by amt.cnet (8.14.6/8.14.6/Submit) id s03J0pCL016186; + Fri, 3 Jan 2014 17:00:51 -0200 +Content-Disposition: inline +User-Agent: Mutt/1.5.21 (2010-09-15) +X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11 +Original-Sender: kvm-owner@vger.kernel.org +Precedence: bulk +List-ID: +X-Mailing-List: kvm@vger.kernel.org +Xref: news.gmane.org gmane.comp.emulators.kvm.devel:117837 +Archived-At: + + +After free_loaded_vmcs executes, the "loaded_vmcs" structure +is kfreed, and now vmx->loaded_vmcs points to a kfreed area. +Subsequent free_loaded_vmcs then attempts to manipulate +vmx->loaded_vmcs. + +Switch the order to avoid the problem. + +https://bugzilla.redhat.com/show_bug.cgi?id=1047892 + +Signed-off-by: Marcelo Tosatti + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index da7837e..2efa33f0 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -7332,8 +7332,8 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu) + struct vcpu_vmx *vmx = to_vmx(vcpu); + + free_vpid(vmx); +- free_nested(vmx); + free_loaded_vmcs(vmx->loaded_vmcs); ++ free_nested(vmx); + kfree(vmx->guest_msrs); + kvm_vcpu_uninit(vcpu); + kmem_cache_free(kvm_vcpu_cache, vmx); +-- +To unsubscribe from this list: send the line "unsubscribe kvm" in +the body of a message to majordomo@vger.kernel.org +More majordomo info at http://vger.kernel.org/majordomo-info.html + diff --git a/kernel.spec b/kernel.spec index 96bb801..d4b5bdd 100644 --- a/kernel.spec +++ b/kernel.spec @@ -760,6 +760,9 @@ Patch25178: ath9k_htc-properly-set-MAC-address-and-BSSID-mask.patch #rhbz 924916 Patch25179: KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch +#rhbz 1047892 +Patch25180: KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch + # END OF PATCH DEFINITIONS %endif @@ -1459,6 +1462,9 @@ ApplyPatch ath9k_htc-properly-set-MAC-address-and-BSSID-mask.patch #rhbz 924916 ApplyPatch KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch +#rhbz 1047892 +ApplyPatch KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch + # END OF PATCH APPLICATIONS %endif @@ -2272,6 +2278,7 @@ fi %changelog * Mon Jan 06 2014 Josh Boyer +- Fix use after free crash in KVM (rhbz 1047892) - Fix oops in KVM with invalid root_hpa (rhbz 924916) - CVE-2013-4579: ath9k_htc improper MAC update (rhbz 1032753 1033072)