Security fix: check if IOMMU page is contained in the pinned physical page

[bugproxy]

== SRU Justification ==
IBM is requesting commit 76fa4975f3ed in powerpc as a security fix.
This commit Fixes: 121f80ba68f1. Commit 76fa4975f3ed also requires
mainline commit 1463edca6734 as a prereq.

Both these commits have already been cc'd to upstream stable, but they
have not landed in Bionic as of yet.

== Fixes ==
1463edca6734 ("vfio/spapr: Use IOMMU pageshift rather than pagesize")
76fa4975f3ed ("KVM: PPC: Check if IOMMU page is contained in the pinned physical page")

== Regression Potential ==
Low. These commits have also been sent to upstream stable, so have had
additional upstream review.

== Test Case ==
A test kernel was built with these patches and tested by the original bug reporter.
The bug reporter states the test kernel resolved the bug.

== Comment: #0 - Leonardo Augusto Guimaraes Garcia - 2018-08-06 12:27:59 ==

Please, add the following security fix to the distro kernel:

76fa4975f3ed KVM: PPC: Check if IOMMU page is contained in the pinned physical page

Also already available in the 4.14 stable tree:

58113603a4ea KVM: PPC: Check if IOMMU page is contained in the pinned physical page

And in the 4.17 stable tree:

970e28cb2c7a KVM: PPC: Check if IOMMU page is contained in the pinned physical page

[Joseph Salisbury (jsalisbury)]

I built a test kernel with commit 76fa4975f3ed. It required commit 1463edca6734d as a prereq.

The test kernel can be downloaded from:
http://kernel.ubuntu.com/~jsalisbury/lp1785675

Can you test this kernel and see if it resolves this bug?

Note about installing test kernels:
* If the test kernel is prior to 4.15(Bionic) you need to install the linux-image and linux-image-extra .deb packages.
* If the test kernel is 4.15(Bionic) or newer, you need to install the linux-modules, linux-modules-extra and linux-image-unsigned .deb packages.

Thanks in advance!

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-08-09 12:24 EDT-------
(In reply to comment #6)
> I built a test kernel with commit 76fa4975f3ed. It required commit
> 1463edca6734d as a prereq.
>
> The test kernel can be downloaded from:
> http://kernel.ubuntu.com/~jsalisbury/lp1785675
>
> Can you test this kernel and see if it resolves this bug?
>
> Note about installing test kernels:
> * If the test kernel is prior to 4.15(Bionic) you need to install the
> linux-image and linux-image-extra .deb packages.
> * If the test kernel is 4.15(Bionic) or newer, you need to install the
> linux-modules, linux-modules-extra and linux-image-unsigned .deb packages.
>
> Thanks in advance!

Hi Joseph,

We working in an environment to exploit it in a test, so sooner if possible I'll test it.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-08-20 12:31 EDT-------
Joseph,

This a kind of test that needs some interventions in the kernels of host and guest, and maybe in the Qemu either to analysis the memory area if affected.

I believe just a sanity test with page size changing between host and guest will be enough to validate it.

I have re-built a kernel package with the patch from source and changing the PAGESIZE support to 4k, then the environment was running with 4k and the guest with 64k without problems.

[Joseph Salisbury (jsalisbury)]

Thanks for testing. I'll submit an SRU request.

[Joseph Salisbury (jsalisbury)]

https://lists.ubuntu.com/archives/kernel-team/2018-August/095103.html

[Brad Figg (brad-figg)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-09-19 22:01 EDT-------
Hi Canonical,

I tested the latest kernel 4.15.0-35 and 4.15.0-34 for comparison and both got similar results with a full stress-ng test by stress-ng in the GUEST and the HOST running the 4.15.0-35 kernel.
eg. command for stress:
$ stress-ng --all $(nproc) --vm-bytes 80% --aggressive --maximize --oomable --timeout 300 --verify --syslog --metrics --times

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.15.0-36.39

---------------
linux (4.15.0-36.39) bionic; urgency=medium

  * CVE-2018-14633
    - iscsi target: Use hex2bin instead of a re-implementation

  * CVE-2018-17182
    - mm: get rid of vmacache_flush_all() entirely

linux (4.15.0-35.38) bionic; urgency=medium

  * linux: 4.15.0-35.38 -proposed tracker (LP: #1791719)

  * device hotplug of vfio devices can lead to deadlock in vfio_pci_release
    (LP: #1792099)
    - SAUCE: vfio -- release device lock before userspace requests

  * L1TF mitigation not effective in some CPU and RAM combinations
    (LP: #1788563)
    - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
    - x86/speculation/l1tf: Fix off-by-one error when warning that system has too
      much RAM
    - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+

  * CVE-2018-15594
    - x86/paravirt: Fix spectre-v2 mitigations for paravirt guests

  * CVE-2017-5715 (Spectre v2 s390x)
    - KVM: s390: implement CPU model only facilities
    - s390: detect etoken facility
    - KVM: s390: add etoken support for guests
    - s390/lib: use expoline for all bcr instructions
    - s390: fix br_r1_trampoline for machines without exrl
    - SAUCE: s390: use expoline thunks for all branches generated by the BPF JIT

  * Ubuntu18.04.1: cpuidle: powernv: Fix promotion from snooze if next state
    disabled (performance) (LP: #1790602)
    - cpuidle: powernv: Fix promotion from snooze if next state disabled

  * Watchdog CPU:19 Hard LOCKUP when kernel crash was triggered (LP: #1790636)
    - powerpc: hard disable irqs in smp_send_stop loop
    - powerpc: Fix deadlock with multiple calls to smp_send_stop
    - powerpc: smp_send_stop do not offline stopped CPUs
    - powerpc/powernv: Fix opal_event_shutdown() called with interrupts disabled

  * Security fix: check if IOMMU page is contained in the pinned physical page
    (LP: #1785675)
    - vfio/spapr: Use IOMMU pageshift rather than pagesize
    - KVM: PPC: Check if IOMMU page is contained in the pinned physical page

  * Missing Intel GPU pci-id's (LP: #1789924)
    - drm/i915/kbl: Add KBL GT2 sku
    - drm/i915/whl: Introducing Whiskey Lake platform
    - drm/i915/aml: Introducing Amber Lake platform
    - drm/i915/cfl: Add a new CFL PCI ID.

  * CVE-2018-15572
    - x86/speculation: Protect against userspace-userspace spectreRSB

  * Support Power Management for Thunderbolt Controller (LP: #1789358)
    - thunderbolt: Handle NULL boot ACL entries properly
    - thunderbolt: Notify userspace when boot_acl is changed
    - thunderbolt: Use 64-bit DMA mask if supported by the platform
    - thunderbolt: Do not unnecessarily call ICM get route
    - thunderbolt: No need to take tb->lock in domain suspend/complete
    - thunderbolt: Use correct ICM commands in system suspend
    - thunderbolt: Add support for runtime PM

  * random oopses on s390 systems using NVMe devices (LP: #1790480)
    - s390/pci: fix out of bounds access during irq setup

  * [Bionic] Spectre v4 mitigation (Speculative Store Bypass Disable) support
    for arm64 using SMC firmware call to set a hardware chicken bit
    (LP: #1787993) // CVE-2018...

[Frank Heimes (fheimes)]

That already in the current cosmic kernel:
$ git log --oneline | grep "Check if IOMMU page is contained in the pinned physical page"
76fa497 KVM: PPC: Check if IOMMU page is contained in the pinned physical page
$ git tag --contains 76fa497
Ubuntu-4.18.0-7.8
Ubuntu-4.18.0-8.9
Ubuntu-4.18.0-9.10
v4.18
So can be marked as Fix Released for cosmic.