[Devel] [PATCH] KVM: VMX: Do not BUG() on out-of-bounds guest IRQ

[Kirill Tkhai]

On 21.09.2017 11:18, Denis Plotnikov wrote:
> From: Jan H. Schönherr <jschoenh at amazon.de>
> 
> The value of the guest_irq argument to vmx_update_pi_irte() is
> ultimately coming from a KVM_IRQFD API call. Do not BUG() in
> vmx_update_pi_irte() if the value is out-of bounds. (Especially,
> since KVM as a whole seems to hang after that.)
> 
> Instead, print a message only once if we find that we don't have a
> route for a certain IRQ (which can be out-of-bounds or within the
> array).
> 
> This fixes CVE-2017-1000252.
> 
> Fixes: efc644048ecde54 ("KVM: x86: Update IRTE for posted-interrupts")
> Signed-off-by: Jan H. Schönherr <jschoenh at amazon.de>
> Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
> (cherry picked from commit 3a8b0677fc6180a467e26cc32ce6b0c09a32f9bb)
> fix #PSBM-72381
> Signed-off-by: Denis Plotnikov <dplotnikov at virtuozzo.com>

This message is in base64 format. Our scripts become broken on such messages.
I'll convert it manually, but, please, use plain text in the future.

Thanks,
Kirill

> ---
>  arch/x86/kvm/vmx.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 9bdb7e7..14c22fb 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -10789,7 +10789,7 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
>  	struct kvm_lapic_irq irq;
>  	struct kvm_vcpu *vcpu;
>  	struct vcpu_data vcpu_info;
> -	int idx, ret = -EINVAL;
> +	int idx, ret = 0;
>  
>  	if (!kvm_arch_has_assigned_device(kvm) ||
>  		!irq_remapping_cap(IRQ_POSTING_CAP))
> @@ -10797,7 +10797,12 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
>  
>  	idx = srcu_read_lock(&kvm->irq_srcu);
>  	irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu);
> -	BUG_ON(guest_irq >= irq_rt->nr_rt_entries);
> +	if (guest_irq >= irq_rt->nr_rt_entries ||
> +	    hlist_empty(&irq_rt->map[guest_irq])) {
> +		pr_warn_once("no route for guest_irq %u/%u (broken user space?)\n",
> +			     guest_irq, irq_rt->nr_rt_entries);
> +		goto out;
> +	}
>  
>  	hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) {
>  		if (e->type != KVM_IRQ_ROUTING_MSI)
>