tree 1a16ff980ec347e08757ab3ae8050a47f3f46045
parent 30e4756a0a1122a53e663e99130dbd560163db94
author Sean Christopherson <seanjc@google.com> 1643762983 +0000
committer COS Cherry Picker <cloud-image-release@prod.google.com> 1661470495 -0700

KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits

Use the recently introduced __try_cmpxchg_user() to update guest PTE A/D
bits instead of mapping the PTE into kernel address space.  The VM_PFNMAP
path is broken as it assumes that vm_pgoff is the base pfn of the mapped
VMA range, which is conceptually wrong as vm_pgoff is the offset relative
to the file and has nothing to do with the pfn.  The horrific hack worked
for the original use case (backing guest memory with /dev/mem), but leads
to accessing "random" pfns for pretty much any other VM_PFNMAP case.

BUG=b/242694075
TEST=http://sponge2/5746147e-f595-4b7e-a4d3-709a5d307e2b
RELEASE_NOTE=Fixed CVE-2022-1158 in Linux Kernel
SOURCE=UPSTREAM(f122dfe4476890d60b8c679128cd2259ec96a24c)

cos-patch: security-high
Fixes: bd53cb35a3e9 ("X86/KVM: Handle PFNs outside of kernel reach when touching GPTEs")
Debugged-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Tested-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Reported-by: syzbot+6cde2282daa792c49ab8@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20220202004945.2540433-4-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Change-Id: I8eab2801d2a6c322f5530f2e14214d5623d85010
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/36294
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Meena Shanmugam <meenashanmugam@google.com>