| Message ID | 20200812141106.6706-1-william.gray@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | [Focal,CVE-2020-15852] x86/ioperm: Fix io bitmap invalidation on Xen PV | expand |
On Wed, Aug 12, 2020 at 10:11:06AM -0400, William Breathitt Gray wrote: > From: Andy Lutomirski <luto@kernel.org> > > tss_invalidate_io_bitmap() wasn't wired up properly through the pvop > machinery, so the TSS and Xen's io bitmap would get out of sync > whenever disabling a valid io bitmap. > > Add a new pvop for tss_invalidate_io_bitmap() to fix it. > > This is XSA-329. > > Fixes: 22fe5b0439dd ("x86/ioperm: Move TSS bitmap update to exit to user work") > Signed-off-by: Andy Lutomirski <luto@kernel.org> > Signed-off-by: Thomas Gleixner <tglx@linutronix.de> > Reviewed-by: Juergen Gross <jgross@suse.com> > Reviewed-by: Thomas Gleixner <tglx@linutronix.de> > Cc: stable@vger.kernel.org > Link: https://lkml.kernel.org/r/d53075590e1f91c19f8af705059d3ff99424c020.1595030016.git.luto@kernel.org > > CVE-2020-15852 > > (cherry picked from commit cadfad870154e14f745ec845708bc17d166065f2) > Signed-off-by: William Breathitt Gray <william.gray@canonical.com> Wrong subject line. Nacked-by: William Breathitt Gray <william.gray@canonical.com> > --- > arch/x86/include/asm/io_bitmap.h | 16 ++++++++++++++++ > arch/x86/include/asm/paravirt.h | 5 +++++ > arch/x86/include/asm/paravirt_types.h | 1 + > arch/x86/kernel/paravirt.c | 3 ++- > arch/x86/kernel/process.c | 18 ++---------------- > arch/x86/xen/enlighten_pv.c | 12 ++++++++++++ > 6 files changed, 38 insertions(+), 17 deletions(-) > > diff --git a/arch/x86/include/asm/io_bitmap.h b/arch/x86/include/asm/io_bitmap.h > index ac1a99ffbd8d..7f080f5c7def 100644 > --- a/arch/x86/include/asm/io_bitmap.h > +++ b/arch/x86/include/asm/io_bitmap.h > @@ -19,12 +19,28 @@ struct task_struct; > void io_bitmap_share(struct task_struct *tsk); > void io_bitmap_exit(struct task_struct *tsk); > > +static inline void native_tss_invalidate_io_bitmap(void) > +{ > + /* > + * Invalidate the I/O bitmap by moving io_bitmap_base outside the > + * TSS limit so any subsequent I/O access from user space will > + * trigger a #GP. > + * > + * This is correct even when VMEXIT rewrites the TSS limit > + * to 0x67 as the only requirement is that the base points > + * outside the limit. > + */ > + this_cpu_write(cpu_tss_rw.x86_tss.io_bitmap_base, > + IO_BITMAP_OFFSET_INVALID); > +} > + > void native_tss_update_io_bitmap(void); > > #ifdef CONFIG_PARAVIRT_XXL > #include <asm/paravirt.h> > #else > #define tss_update_io_bitmap native_tss_update_io_bitmap > +#define tss_invalidate_io_bitmap native_tss_invalidate_io_bitmap > #endif > > #else > diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h > index 694d8daf4983..0296dd66c167 100644 > --- a/arch/x86/include/asm/paravirt.h > +++ b/arch/x86/include/asm/paravirt.h > @@ -296,6 +296,11 @@ static inline void write_idt_entry(gate_desc *dt, int entry, const gate_desc *g) > } > > #ifdef CONFIG_X86_IOPL_IOPERM > +static inline void tss_invalidate_io_bitmap(void) > +{ > + PVOP_VCALL0(cpu.invalidate_io_bitmap); > +} > + > static inline void tss_update_io_bitmap(void) > { > PVOP_VCALL0(cpu.update_io_bitmap); > diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h > index 732f62e04ddb..8dfcb2508e6d 100644 > --- a/arch/x86/include/asm/paravirt_types.h > +++ b/arch/x86/include/asm/paravirt_types.h > @@ -141,6 +141,7 @@ struct pv_cpu_ops { > void (*load_sp0)(unsigned long sp0); > > #ifdef CONFIG_X86_IOPL_IOPERM > + void (*invalidate_io_bitmap)(void); > void (*update_io_bitmap)(void); > #endif > > diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c > index c131ba4e70ef..97b4ce839b4c 100644 > --- a/arch/x86/kernel/paravirt.c > +++ b/arch/x86/kernel/paravirt.c > @@ -343,7 +343,8 @@ struct paravirt_patch_template pv_ops = { > .cpu.swapgs = native_swapgs, > > #ifdef CONFIG_X86_IOPL_IOPERM > - .cpu.update_io_bitmap = native_tss_update_io_bitmap, > + .cpu.invalidate_io_bitmap = native_tss_invalidate_io_bitmap, > + .cpu.update_io_bitmap = native_tss_update_io_bitmap, > #endif > > .cpu.start_context_switch = paravirt_nop, > diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c > index 3d88300ec306..070383626d7f 100644 > --- a/arch/x86/kernel/process.c > +++ b/arch/x86/kernel/process.c > @@ -323,20 +323,6 @@ void arch_setup_new_exec(void) > } > > #ifdef CONFIG_X86_IOPL_IOPERM > -static inline void tss_invalidate_io_bitmap(struct tss_struct *tss) > -{ > - /* > - * Invalidate the I/O bitmap by moving io_bitmap_base outside the > - * TSS limit so any subsequent I/O access from user space will > - * trigger a #GP. > - * > - * This is correct even when VMEXIT rewrites the TSS limit > - * to 0x67 as the only requirement is that the base points > - * outside the limit. > - */ > - tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID; > -} > - > static inline void switch_to_bitmap(unsigned long tifp) > { > /* > @@ -347,7 +333,7 @@ static inline void switch_to_bitmap(unsigned long tifp) > * user mode. > */ > if (tifp & _TIF_IO_BITMAP) > - tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw)); > + tss_invalidate_io_bitmap(); > } > > static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm) > @@ -381,7 +367,7 @@ void native_tss_update_io_bitmap(void) > u16 *base = &tss->x86_tss.io_bitmap_base; > > if (!test_thread_flag(TIF_IO_BITMAP)) { > - tss_invalidate_io_bitmap(tss); > + native_tss_invalidate_io_bitmap(); > return; > } > > diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c > index 507f4fb88fa7..9621d31104b6 100644 > --- a/arch/x86/xen/enlighten_pv.c > +++ b/arch/x86/xen/enlighten_pv.c > @@ -841,6 +841,17 @@ static void xen_load_sp0(unsigned long sp0) > } > > #ifdef CONFIG_X86_IOPL_IOPERM > +static void xen_invalidate_io_bitmap(void) > +{ > + struct physdev_set_iobitmap iobitmap = { > + .bitmap = 0, > + .nr_ports = 0, > + }; > + > + native_tss_invalidate_io_bitmap(); > + HYPERVISOR_physdev_op(PHYSDEVOP_set_iobitmap, &iobitmap); > +} > + > static void xen_update_io_bitmap(void) > { > struct physdev_set_iobitmap iobitmap; > @@ -1070,6 +1081,7 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = { > .load_sp0 = xen_load_sp0, > > #ifdef CONFIG_X86_IOPL_IOPERM > + .invalidate_io_bitmap = xen_invalidate_io_bitmap, > .update_io_bitmap = xen_update_io_bitmap, > #endif > .io_delay = xen_io_delay, > -- > 2.25.1 >
diff --git a/arch/x86/include/asm/io_bitmap.h b/arch/x86/include/asm/io_bitmap.h index ac1a99ffbd8d..7f080f5c7def 100644 --- a/arch/x86/include/asm/io_bitmap.h +++ b/arch/x86/include/asm/io_bitmap.h @@ -19,12 +19,28 @@ struct task_struct; void io_bitmap_share(struct task_struct *tsk); void io_bitmap_exit(struct task_struct *tsk); +static inline void native_tss_invalidate_io_bitmap(void) +{ + /* + * Invalidate the I/O bitmap by moving io_bitmap_base outside the + * TSS limit so any subsequent I/O access from user space will + * trigger a #GP. + * + * This is correct even when VMEXIT rewrites the TSS limit + * to 0x67 as the only requirement is that the base points + * outside the limit. + */ + this_cpu_write(cpu_tss_rw.x86_tss.io_bitmap_base, + IO_BITMAP_OFFSET_INVALID); +} + void native_tss_update_io_bitmap(void); #ifdef CONFIG_PARAVIRT_XXL #include <asm/paravirt.h> #else #define tss_update_io_bitmap native_tss_update_io_bitmap +#define tss_invalidate_io_bitmap native_tss_invalidate_io_bitmap #endif #else diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h index 694d8daf4983..0296dd66c167 100644 --- a/arch/x86/include/asm/paravirt.h +++ b/arch/x86/include/asm/paravirt.h @@ -296,6 +296,11 @@ static inline void write_idt_entry(gate_desc *dt, int entry, const gate_desc *g) } #ifdef CONFIG_X86_IOPL_IOPERM +static inline void tss_invalidate_io_bitmap(void) +{ + PVOP_VCALL0(cpu.invalidate_io_bitmap); +} + static inline void tss_update_io_bitmap(void) { PVOP_VCALL0(cpu.update_io_bitmap); diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h index 732f62e04ddb..8dfcb2508e6d 100644 --- a/arch/x86/include/asm/paravirt_types.h +++ b/arch/x86/include/asm/paravirt_types.h @@ -141,6 +141,7 @@ struct pv_cpu_ops { void (*load_sp0)(unsigned long sp0); #ifdef CONFIG_X86_IOPL_IOPERM + void (*invalidate_io_bitmap)(void); void (*update_io_bitmap)(void); #endif diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c index c131ba4e70ef..97b4ce839b4c 100644 --- a/arch/x86/kernel/paravirt.c +++ b/arch/x86/kernel/paravirt.c @@ -343,7 +343,8 @@ struct paravirt_patch_template pv_ops = { .cpu.swapgs = native_swapgs, #ifdef CONFIG_X86_IOPL_IOPERM - .cpu.update_io_bitmap = native_tss_update_io_bitmap, + .cpu.invalidate_io_bitmap = native_tss_invalidate_io_bitmap, + .cpu.update_io_bitmap = native_tss_update_io_bitmap, #endif .cpu.start_context_switch = paravirt_nop, diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c index 3d88300ec306..070383626d7f 100644 --- a/arch/x86/kernel/process.c +++ b/arch/x86/kernel/process.c @@ -323,20 +323,6 @@ void arch_setup_new_exec(void) } #ifdef CONFIG_X86_IOPL_IOPERM -static inline void tss_invalidate_io_bitmap(struct tss_struct *tss) -{ - /* - * Invalidate the I/O bitmap by moving io_bitmap_base outside the - * TSS limit so any subsequent I/O access from user space will - * trigger a #GP. - * - * This is correct even when VMEXIT rewrites the TSS limit - * to 0x67 as the only requirement is that the base points - * outside the limit. - */ - tss->x86_tss.io_bitmap_base = IO_BITMAP_OFFSET_INVALID; -} - static inline void switch_to_bitmap(unsigned long tifp) { /* @@ -347,7 +333,7 @@ static inline void switch_to_bitmap(unsigned long tifp) * user mode. */ if (tifp & _TIF_IO_BITMAP) - tss_invalidate_io_bitmap(this_cpu_ptr(&cpu_tss_rw)); + tss_invalidate_io_bitmap(); } static void tss_copy_io_bitmap(struct tss_struct *tss, struct io_bitmap *iobm) @@ -381,7 +367,7 @@ void native_tss_update_io_bitmap(void) u16 *base = &tss->x86_tss.io_bitmap_base; if (!test_thread_flag(TIF_IO_BITMAP)) { - tss_invalidate_io_bitmap(tss); + native_tss_invalidate_io_bitmap(); return; } diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c index 507f4fb88fa7..9621d31104b6 100644 --- a/arch/x86/xen/enlighten_pv.c +++ b/arch/x86/xen/enlighten_pv.c @@ -841,6 +841,17 @@ static void xen_load_sp0(unsigned long sp0) } #ifdef CONFIG_X86_IOPL_IOPERM +static void xen_invalidate_io_bitmap(void) +{ + struct physdev_set_iobitmap iobitmap = { + .bitmap = 0, + .nr_ports = 0, + }; + + native_tss_invalidate_io_bitmap(); + HYPERVISOR_physdev_op(PHYSDEVOP_set_iobitmap, &iobitmap); +} + static void xen_update_io_bitmap(void) { struct physdev_set_iobitmap iobitmap; @@ -1070,6 +1081,7 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = { .load_sp0 = xen_load_sp0, #ifdef CONFIG_X86_IOPL_IOPERM + .invalidate_io_bitmap = xen_invalidate_io_bitmap, .update_io_bitmap = xen_update_io_bitmap, #endif .io_delay = xen_io_delay,