Fix use after free crash in KVM (rhbz 1047892)
This commit is contained in:
Josh Boyer
parent
4f0a3478f5
commit
c2bce50a1b
88
KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch
Normal file
88
KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch
Normal file
@ -0,0 +1,88 @@
|
||||
Bugzilla: 1047892
|
||||
Upstream-status: Submitted for 3.14
|
||||
|
||||
Path: news.gmane.org!not-for-mail
|
||||
From: Marcelo Tosatti <mtosatti@redhat.com>
|
||||
Newsgroups: gmane.comp.emulators.kvm.devel
|
||||
Subject: KVM: VMX: fix use after free of vmx->loaded_vmcs
|
||||
Date: Fri, 3 Jan 2014 17:00:51 -0200
|
||||
Lines: 31
|
||||
Approved: news@gmane.org
|
||||
Message-ID: <20140103190051.GA16151@amt.cnet>
|
||||
NNTP-Posting-Host: plane.gmane.org
|
||||
Mime-Version: 1.0
|
||||
Content-Type: text/plain; charset=us-ascii
|
||||
X-Trace: ger.gmane.org 1388775805 10008 80.91.229.3 (3 Jan 2014 19:03:25 GMT)
|
||||
X-Complaints-To: usenet@ger.gmane.org
|
||||
NNTP-Posting-Date: Fri, 3 Jan 2014 19:03:25 +0000 (UTC)
|
||||
Cc: Jan Kiszka <jan.kiszka@web.de>, Paolo Bonzini <pbonzini@redhat.com>
|
||||
To: kvm-devel <kvm@vger.kernel.org>
|
||||
Original-X-From: kvm-owner@vger.kernel.org Fri Jan 03 20:03:30 2014
|
||||
Return-path: <kvm-owner@vger.kernel.org>
|
||||
Envelope-to: gcekd-kvm-devel@plane.gmane.org
|
||||
Original-Received: from vger.kernel.org ([209.132.180.67])
|
||||
by plane.gmane.org with esmtp (Exim 4.69)
|
||||
(envelope-from <kvm-owner@vger.kernel.org>)
|
||||
id 1VzA1p-0000BI-F0
|
||||
for gcekd-kvm-devel@plane.gmane.org; Fri, 03 Jan 2014 20:03:29 +0100
|
||||
Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
|
||||
id S1752819AbaACTDZ (ORCPT <rfc822;gcekd-kvm-devel@m.gmane.org>);
|
||||
Fri, 3 Jan 2014 14:03:25 -0500
|
||||
Original-Received: from mx1.redhat.com ([209.132.183.28]:26936 "EHLO mx1.redhat.com"
|
||||
rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
|
||||
id S1751681AbaACTDY (ORCPT <rfc822;kvm@vger.kernel.org>);
|
||||
Fri, 3 Jan 2014 14:03:24 -0500
|
||||
Original-Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
|
||||
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s03J3NIr007205
|
||||
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
|
||||
Fri, 3 Jan 2014 14:03:24 -0500
|
||||
Original-Received: from amt.cnet (vpn1-4-118.gru2.redhat.com [10.97.4.118])
|
||||
by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id s03J3Mxl004396;
|
||||
Fri, 3 Jan 2014 14:03:23 -0500
|
||||
Original-Received: from amt.cnet (localhost [127.0.0.1])
|
||||
by amt.cnet (Postfix) with ESMTP id 98901104ADF;
|
||||
Fri, 3 Jan 2014 17:00:53 -0200 (BRST)
|
||||
Original-Received: (from marcelo@localhost)
|
||||
by amt.cnet (8.14.6/8.14.6/Submit) id s03J0pCL016186;
|
||||
Fri, 3 Jan 2014 17:00:51 -0200
|
||||
Content-Disposition: inline
|
||||
User-Agent: Mutt/1.5.21 (2010-09-15)
|
||||
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11
|
||||
Original-Sender: kvm-owner@vger.kernel.org
|
||||
Precedence: bulk
|
||||
List-ID: <kvm.vger.kernel.org>
|
||||
X-Mailing-List: kvm@vger.kernel.org
|
||||
Xref: news.gmane.org gmane.comp.emulators.kvm.devel:117837
|
||||
Archived-At: <http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/117837>
|
||||
|
||||
|
||||
After free_loaded_vmcs executes, the "loaded_vmcs" structure
|
||||
is kfreed, and now vmx->loaded_vmcs points to a kfreed area.
|
||||
Subsequent free_loaded_vmcs then attempts to manipulate
|
||||
vmx->loaded_vmcs.
|
||||
|
||||
Switch the order to avoid the problem.
|
||||
|
||||
https://bugzilla.redhat.com/show_bug.cgi?id=1047892
|
||||
|
||||
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
|
||||
|
||||
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
|
||||
index da7837e..2efa33f0 100644
|
||||
--- a/arch/x86/kvm/vmx.c
|
||||
+++ b/arch/x86/kvm/vmx.c
|
||||
@@ -7332,8 +7332,8 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
|
||||
struct vcpu_vmx *vmx = to_vmx(vcpu);
|
||||
|
||||
free_vpid(vmx);
|
||||
- free_nested(vmx);
|
||||
free_loaded_vmcs(vmx->loaded_vmcs);
|
||||
+ free_nested(vmx);
|
||||
kfree(vmx->guest_msrs);
|
||||
kvm_vcpu_uninit(vcpu);
|
||||
kmem_cache_free(kvm_vcpu_cache, vmx);
|
||||
--
|
||||
To unsubscribe from this list: send the line "unsubscribe kvm" in
|
||||
the body of a message to majordomo@vger.kernel.org
|
||||
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
||||
|
||||
@ -760,6 +760,9 @@ Patch25178: ath9k_htc-properly-set-MAC-address-and-BSSID-mask.patch
|
||||
#rhbz 924916
|
||||
Patch25179: KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch
|
||||
|
||||
#rhbz 1047892
|
||||
Patch25180: KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
@ -1459,6 +1462,9 @@ ApplyPatch ath9k_htc-properly-set-MAC-address-and-BSSID-mask.patch
|
||||
#rhbz 924916
|
||||
ApplyPatch KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch
|
||||
|
||||
#rhbz 1047892
|
||||
ApplyPatch KVM-VMX-fix-use-after-free-of-vmx-loaded_vmcs.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
@ -2272,6 +2278,7 @@ fi
|
||||
|
||||
%changelog
|
||||
* Mon Jan 06 2014 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Fix use after free crash in KVM (rhbz 1047892)
|
||||
- Fix oops in KVM with invalid root_hpa (rhbz 924916)
|
||||
- CVE-2013-4579: ath9k_htc improper MAC update (rhbz 1032753 1033072)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user