[kernel] Fix use after free crash in KVM (rhbz 1047892)
Josh Boyer
jwboyer at fedoraproject.org
Mon Jan 6 19:21:34 UTC 2014
commit 7a3be4ba910b95ab4d2044f66eb2fd92f1e9dff9
Author: Josh Boyer <jwboyer at fedoraproject.org>
Date: Mon Jan 6 14:20:47 2014 -0500
Fix use after free crash in KVM (rhbz 1047892)
...VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch | 88 ++++++++++++++++++++
kernel.spec | 7 ++
2 files changed, 95 insertions(+), 0 deletions(-)
---
diff --git a/KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch b/KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch
new file mode 100644
index 0000000..5867231
--- /dev/null
+++ b/KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch
@@ -0,0 +1,88 @@
+Bugzilla: 1047892
+Upstream-status: Submitted for 3.14
+
+Path: news.gmane.org!not-for-mail
+From: Marcelo Tosatti <mtosatti at redhat.com>
+Newsgroups: gmane.comp.emulators.kvm.devel
+Subject: KVM: VMX: fix use after free of vmx->loaded_vmcs
+Date: Fri, 3 Jan 2014 17:00:51 -0200
+Lines: 31
+Approved: news at gmane.org
+Message-ID: <20140103190051.GA16151 at amt.cnet>
+NNTP-Posting-Host: plane.gmane.org
+Mime-Version: 1.0
+Content-Type: text/plain; charset=us-ascii
+X-Trace: ger.gmane.org 1388775805 10008 80.91.229.3 (3 Jan 2014 19:03:25 GMT)
+X-Complaints-To: usenet at ger.gmane.org
+NNTP-Posting-Date: Fri, 3 Jan 2014 19:03:25 +0000 (UTC)
+Cc: Jan Kiszka <jan.kiszka at web.de>, Paolo Bonzini <pbonzini at redhat.com>
+To: kvm-devel <kvm at vger.kernel.org>
+Original-X-From: kvm-owner at vger.kernel.org Fri Jan 03 20:03:30 2014
+Return-path: <kvm-owner at vger.kernel.org>
+Envelope-to: gcekd-kvm-devel at plane.gmane.org
+Original-Received: from vger.kernel.org ([209.132.180.67])
+ by plane.gmane.org with esmtp (Exim 4.69)
+ (envelope-from <kvm-owner at vger.kernel.org>)
+ id 1VzA1p-0000BI-F0
+ for gcekd-kvm-devel at plane.gmane.org; Fri, 03 Jan 2014 20:03:29 +0100
+Original-Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+ id S1752819AbaACTDZ (ORCPT <rfc822;gcekd-kvm-devel at m.gmane.org>);
+ Fri, 3 Jan 2014 14:03:25 -0500
+Original-Received: from mx1.redhat.com ([209.132.183.28]:26936 "EHLO mx1.redhat.com"
+ rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
+ id S1751681AbaACTDY (ORCPT <rfc822;kvm at vger.kernel.org>);
+ Fri, 3 Jan 2014 14:03:24 -0500
+Original-Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
+ by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s03J3NIr007205
+ (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
+ Fri, 3 Jan 2014 14:03:24 -0500
+Original-Received: from amt.cnet (vpn1-4-118.gru2.redhat.com [10.97.4.118])
+ by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id s03J3Mxl004396;
+ Fri, 3 Jan 2014 14:03:23 -0500
+Original-Received: from amt.cnet (localhost [127.0.0.1])
+ by amt.cnet (Postfix) with ESMTP id 98901104ADF;
+ Fri, 3 Jan 2014 17:00:53 -0200 (BRST)
+Original-Received: (from marcelo at localhost)
+ by amt.cnet (8.14.6/8.14.6/Submit) id s03J0pCL016186;
+ Fri, 3 Jan 2014 17:00:51 -0200
+Content-Disposition: inline
+User-Agent: Mutt/1.5.21 (2010-09-15)
+X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11
+Original-Sender: kvm-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <kvm.vger.kernel.org>
+X-Mailing-List: kvm at vger.kernel.org
+Xref: news.gmane.org gmane.comp.emulators.kvm.devel:117837
+Archived-At: <http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/117837>
+
+
+After free_loaded_vmcs executes, the "loaded_vmcs" structure
+is kfreed, and now vmx->loaded_vmcs points to a kfreed area.
+Subsequent free_loaded_vmcs then attempts to manipulate
+vmx->loaded_vmcs.
+
+Switch the order to avoid the problem.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1047892
+
+Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index da7837e..2efa33f0 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7332,8 +7332,8 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
+
+ free_vpid(vmx);
+- free_nested(vmx);
+ free_loaded_vmcs(vmx->loaded_vmcs);
++ free_nested(vmx);
+ kfree(vmx->guest_msrs);
+ kvm_vcpu_uninit(vcpu);
+ kmem_cache_free(kvm_vcpu_cache, vmx);
+--
+To unsubscribe from this list: send the line "unsubscribe kvm" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
+
diff --git a/kernel.spec b/kernel.spec
index d772fb3..4638156 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -718,6 +718,9 @@ Patch25172: xen-netback-Include-header-for-vmalloc.patch
#rhbz 924916
Patch25179: KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch
+#rhbz 1047892
+Patch25180: KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch
+
# END OF PATCH DEFINITIONS
%endif
@@ -1399,6 +1402,9 @@ ApplyPatch xen-netback-Include-header-for-vmalloc.patch
#rhbz 924916
ApplyPatch KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch
+#rhbz 1047892
+ApplyPatch KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -2214,6 +2220,7 @@ fi
# || ||
%changelog
* Mon Jan 06 2014 Josh Boyer <jwboyer at fedoraproject.org>
+- Fix use after free crash in KVM (rhbz 1047892)
- Fix oops in KVM with invalid root_hpa (rhbz 924916)
* Sun Jan 05 2014 Josh Boyer <jwboyer at fedoraproject.org> - 3.13-0.0.rc7.git0.1
More information about the scm-commits
mailing list