diff options
| author | Justin M. Forbes <jforbes@redhat.com> | 2016-12-15 08:40:46 -0600 |
|---|---|---|
| committer | Justin M. Forbes <jforbes@redhat.com> | 2016-12-15 08:40:46 -0600 |
| commit | e4e004a33cab3efd2bee68dccd3aa8a37e7ac741 (patch) | |
| tree | a204cafc8de8c33e00598a3112d5dff90e57287a | |
| parent | 7fb86ae95f9711b9fe57f3e4f95259d6cbec7120 (diff) | |
| download | kernel-e4e004a33cab3efd2bee68dccd3aa8a37e7ac741.tar.gz kernel-e4e004a33cab3efd2bee68dccd3aa8a37e7ac741.tar.xz kernel-e4e004a33cab3efd2bee68dccd3aa8a37e7ac741.zip | |
CVE-2016-9588 fix possible DoS in nVMX (rhbz 1404924 1404925)
| -rw-r--r-- | kernel.spec | 7 | ||||
| -rw-r--r-- | kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch | 68 |
2 files changed, 75 insertions, 0 deletions
diff --git a/kernel.spec b/kernel.spec index 7a752630f..bc53c52ff 100644 --- a/kernel.spec +++ b/kernel.spec @@ -640,6 +640,9 @@ Patch855: 0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch # CVE-2016-9755 rhbz 1400904 1400905 Patch856: 0001-netfilter-ipv6-nf_defrag-drop-mangled-skb-on-ream-er.patch +# CVE-2016-9588 rhbz 1404924 1404925 +Patch857: kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch + # END OF PATCH DEFINITIONS %endif @@ -2167,6 +2170,10 @@ fi # # %changelog +* Thu Dec 15 2016 Justin M. Forbes <jforbes@fedoraproject.org> +- CVE-2016-9588 fix possible DoS in nVMX (rhbz 1404924 1404925) +- Turn off CONFIG_IWLWIFI_PCIE_RTPM as it can cause wifi disconnects + * Mon Dec 12 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.14-200 - Linux v4.8.14 - CVE-2016-8399 Fix out OOB stack read in memcpy_fromiovec (rhbz 1403833 1403834) diff --git a/kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch b/kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch new file mode 100644 index 000000000..b408fc604 --- /dev/null +++ b/kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch @@ -0,0 +1,68 @@ +From: Jim Mattson <jmattson@google.com>
+To: kvm@vger.kernel.org
+Cc: Jim Mattson <jmattson@google.com>
+Subject: [PATCH] kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
+Date: Wed, 14 Dec 2016 11:41:59 -0800
+
+When L2 exits to L0 due to "exception or NMI", software exceptions
+(#BP and #OF) for which L1 has requested an intercept should be
+handled by L1 rather than L0. Previously, only hardware exceptions
+were forwarded to L1.
+
+Signed-off-by: Jim Mattson <jmattson@google.com>
+---
+ arch/x86/kvm/vmx.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 5382b82..64774f4 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1343,10 +1343,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
+ return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
+ }
+
+-static inline bool is_exception(u32 intr_info)
++static inline bool is_nmi(u32 intr_info)
+ {
+ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
+- == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
++ == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
+ }
+
+ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+@@ -5476,7 +5476,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
+ if (is_machine_check(intr_info))
+ return handle_machine_check(vcpu);
+
+- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
++ if (is_nmi(intr_info))
+ return 1; /* already handled by vmx_vcpu_run() */
+
+ if (is_no_device(intr_info)) {
+@@ -8018,7 +8018,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
+
+ switch (exit_reason) {
+ case EXIT_REASON_EXCEPTION_NMI:
+- if (!is_exception(intr_info))
++ if (is_nmi(intr_info))
+ return false;
+ else if (is_page_fault(intr_info))
+ return enable_ept;
+@@ -8611,8 +8611,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
+ kvm_machine_check();
+
+ /* We need to handle NMIs before interrupts are enabled */
+- if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
+- (exit_intr_info & INTR_INFO_VALID_MASK)) {
++ if (is_nmi(exit_intr_info)) {
+ kvm_before_handle_nmi(&vmx->vcpu);
+ asm("int $2");
+ kvm_after_handle_nmi(&vmx->vcpu);
+--
+2.8.0.rc3.226.g39d4020
+
+--
+To unsubscribe from this list: send the line "unsubscribe kvm" in
+the body of a message to majordomo@vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
|