From 710481f30b26856f462d3e5923bf69b32c12e097 Mon Sep 17 00:00:00 2001
From: Artem Savkov <asavkov@redhat.com>
Date: Fri, 3 Sep 2021 16:00:17 +0200
Subject: [KPATCH CVE-2021-22543] KVM: do not allow mapping valid but
non-reference-counted pages
Kernels:
3.10.0-1160.el7
3.10.0-1160.2.1.el7
3.10.0-1160.2.2.el7
3.10.0-1160.6.1.el7
3.10.0-1160.11.1.el7
3.10.0-1160.15.2.el7
3.10.0-1160.21.1.el7
3.10.0-1160.24.1.el7
3.10.0-1160.25.1.el7
3.10.0-1160.31.1.el7
3.10.0-1160.36.2.el7
3.10.0-1160.41.1.el7
Changes since last build:
[x86_64]:
kvm_main.o: changed function: __gfn_to_pfn_memslot
[ppc64le]:
kvm_main.o: changed function: gfn_to_page
kvm_main.o: changed function: gfn_to_pfn
kvm_main.o: changed function: gfn_to_pfn_memslot
kvm_main.o: changed function: gfn_to_pfn_prot
kvm_main.o: changed function: hva_to_pfn
kvm_main.o: changed function: kvm_vcpu_gfn_to_page
kvm_main.o: changed function: kvm_vcpu_gfn_to_pfn
---------------------------
Kernels:
3.10.0-1160.2.1.el7
3.10.0-1160.2.2.el7
3.10.0-1160.6.1.el7
3.10.0-1160.11.1.el7
3.10.0-1160.15.2.el7
3.10.0-1160.21.1.el7
3.10.0-1160.24.1.el7
3.10.0-1160.25.1.el7
3.10.0-1160.31.1.el7
3.10.0-1160.36.2.el7
3.10.0-1160.41.1.el7
3.10.0-1160.42.2.el7
Modifications: none
Kpatch-MR: https://gitlab.com/kpatch-dev/rhel-7/-/merge_requests/7
Approved-by: Yannick Cote (@ycote1)
Approved-by: Joe Lawrence (@joe.lawrence)
Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-7/-/merge_requests/259
commit 64b6dd5036622d9fab20cea237ae19402a1a2ee3
Author: Jon Maloy <jmaloy@redhat.com>
Date: Tue Jul 13 15:28:38 2021 -0400
KVM: do not allow mapping valid but non-reference-counted pages
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1975511
Upstream: commit f8be156be163a052a067306417cd0ff679068c97
CVE-2021-22543
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=39156005
Conflicts: The upstream version hva_to_pfn_remapped() has been upgraded
with lock support and a 'writeable' parameter. Those changes
entail a code conflict, but not functional conflict, with
this commit.
commit f8be156be163a052a067306417cd0ff679068c97
Author: Nicholas Piggin <npiggin@gmail.com>
Date: Thu Jun 24 08:29:04 2021 -0400
KVM: do not allow mapping valid but non-reference-counted pages
It's possible to create a region which maps valid but non-refcounted
pages (e.g., tail pages of non-compound higher order allocations). These
host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family
of APIs, which take a reference to the page, which takes it from 0 to 1.
When the reference is dropped, this will free the page incorrectly.
Fix this by only taking a reference on valid pages if it was non-zero,
which indicates it is participating in normal refcounting (and can be
released with put_page).
This addresses CVE-2021-22543.
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Tested-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Artem Savkov <asavkov@redhat.com>
---
virt/kvm/kvm_main.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 4b01a017b262..2f40d5fe257d 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1479,6 +1479,13 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
return true;
}
+static int kvm_try_get_pfn(kvm_pfn_t pfn)
+{
+ if (kvm_is_reserved_pfn(pfn))
+ return 1;
+ return get_page_unless_zero(pfn_to_page(pfn));
+}
+
static int hva_to_pfn_remapped(struct vm_area_struct *vma,
unsigned long addr, bool *async,
bool write_fault, kvm_pfn_t *p_pfn)
@@ -1514,11 +1521,19 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
* Whoever called remap_pfn_range is also going to call e.g.
* unmap_mapping_range before the underlying pages are freed,
* causing a call to our MMU notifier.
- */
- kvm_get_pfn(pfn);
+ *
+ * Certain IO or PFNMAP mappings can be backed with valid
+ * struct pages, but be allocated without refcounting e.g.,
+ * tail pages of non-compound higher order allocations, which
+ * would then underflow the refcount when the caller does the
+ * required put_page. Don't allow those pages here.
+ */
+ if (!kvm_try_get_pfn(pfn))
+ r = -EFAULT;
*p_pfn = pfn;
- return 0;
+
+ return r;
}
/*
--
2.26.3