Patch "KVM: VMX: Do not BUG() on out-of-bounds guest IRQ" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

KVM: VMX: Do not BUG() on out-of-bounds guest IRQ

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
kvm-vmx-do-not-bug-on-out-of-bounds-guest-irq.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: =?UTF-8?q?Jan=20H=2E=20Sch=C3=B6nherr?= <[email protected]>
Date: Thu, 7 Sep 2017 19:02:30 +0100
Subject: KVM: VMX: Do not BUG() on out-of-bounds guest IRQ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Jan H. Schönherr <[email protected]>

commit 3a8b0677fc6180a467e26cc32ce6b0c09a32f9bb upstream.

The value of the guest_irq argument to vmx_update_pi_irte() is ultimately coming from a KVM_IRQFD API call. Do not BUG() in vmx_update_pi_irte() if the value is out-of bounds. (Especially, since KVM as a whole seems to hang after that.)

Instead, print a message only once if we find that we don't have a route for a certain IRQ (which can be out-of-bounds or within the array).

This fixes CVE-2017-1000252.

---
 arch/x86/kvm/vmx.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

@@ -10755,7 +10755,7 @@ static int vmx_update_pi_irte(struct kvm
 	struct kvm_lapic_irq irq;
 	struct kvm_vcpu *vcpu;
 	struct vcpu_data vcpu_info;
-	int idx, ret = -EINVAL;
+	int idx, ret = 0;
 
 	if (!kvm_arch_has_assigned_device(kvm) ||
 		!irq_remapping_cap(IRQ_POSTING_CAP))

@@ -10763,7 +10763,12 @@ static int vmx_update_pi_irte(struct kvm
 
 	idx = srcu_read_lock(&kvm->irq_srcu);
 	irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu);
-	BUG_ON(guest_irq >= irq_rt->nr_rt_entries);
+	if (guest_irq >= irq_rt->nr_rt_entries ||
+	    hlist_empty(&irq_rt->map[guest_irq])) {
+		pr_warn_once("no route for guest_irq %u/%u (broken user space?)\n",
+			     guest_irq, irq_rt->nr_rt_entries);
+		goto out;
+	}
 
 	hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) {
 		if (e->type != KVM_IRQ_ROUTING_MSI)

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/kvm-vmx-do-not-bug-on-out-of-bounds-guest-irq.patch