DEBIAN-CVE-2023-53319

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle kvmarminit failure correctly in finalizepkvm Currently there is no synchronisation between finalizepkvm() and kvmarminit() initcalls. The finalizepkvm() proceeds happily even if kvmarminit() fails resulting in the following warning on all the CPUs and eventually a HYP panic: | kvm [1]: IPA Size Limit: 48 bits | kvm [1]: Failed to init hyp memory protection | kvm [1]: error initializing Hyp mode: -22 | | <snip> | | WARNING: CPU: 0 PID: 0 at arch/arm64/kvm/pkvm.c:226 _kvmhostprotfinalize+0x30/0x50 | Modules linked in: | CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0 #237 | Hardware name: FVP Base RevC (DT) | pstate: 634020c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) | pc : kvmhostprotfinalize+0x30/0x50 | lr : flushsmpcallfunctionqueue+0xd8/0x230 | | Call trace: | kvmhostprotfinalize+0x3c/0x50 | oneachcpucondmask+0x3c/0x6c | pkvmdrophostprivileges+0x4c/0x78 | finalizepkvm+0x3c/0x5c | dooneinitcall+0xcc/0x240 | doinitcalllevel+0x8c/0xac | doinitcalls+0x54/0x94 | dobasicsetup+0x1c/0x28 | kernelinitfreeable+0x100/0x16c | kernelinit+0x20/0x1a0 | retfromfork+0x10/0x20 | Failed to finalize Hyp protection: -22 | dtb=fvp-base-revc.dtb | kvm [95]: nVHE hyp BUG at: arch/arm64/kvm/hyp/nvhe/memprotect.c:540! | kvm [95]: nVHE call trace: | kvm [95]: [<ffff800081052984>] _kvmnvhehyppanic+0xac/0xf8 | kvm [95]: [<ffff800081059644>] _kvmnvhehandlehostmemabort+0x1a0/0x2ac | kvm [95]: [<ffff80008105511c>] _kvmnvhehandletrap+0x4c/0x160 | kvm [95]: [<ffff8000810540fc>] _kvmnvheskippauthsave+0x4/0x4 | kvm [95]: ---[ end nVHE call trace ]--- | kvm [95]: Hyp Offset: 0xfffe8db00ffa0000 | Kernel panic - not syncing: HYP panic: | PS:a34023c9 PC:0000f250710b973c ESR:00000000f2000800 | FAR:ffff000800cb00d0 HPFAR:000000000880cb00 PAR:0000000000000000 | VCPU:0000000000000000 | CPU: 3 PID: 95 Comm: kworker/u16:2 Tainted: G W 6.4.0 #237 | Hardware name: FVP Base RevC (DT) | Workqueue: rpciod rpcasyncschedule | Call trace: | dumpbacktrace+0xec/0x108 | showstack+0x18/0x2c | dumpstacklvl+0x50/0x68 | dumpstack+0x18/0x24 | panic+0x138/0x33c | nvhehyppanichandler+0x100/0x184 | newslab+0x23c/0x54c | _slaballoc+0x3e4/0x770 | kmemcacheallocnode+0x1f0/0x278 | _allocskb+0xdc/0x294 | tcpstreamallocskb+0x2c/0xf0 | tcpsendmsglocked+0x3d0/0xda4 | tcpsendmsg+0x38/0x5c | inetsendmsg+0x44/0x60 | socksendmsg+0x1c/0x34 | xprtsocksendmsg+0xdc/0x274 | xstcpsendrequest+0x1ac/0x28c | xprttransmit+0xcc/0x300 | calltransmit+0x78/0x90 | _rpcexecute+0x114/0x3d8 | rpcasyncschedule+0x28/0x48 | processonework+0x1d8/0x314 | workerthread+0x248/0x474 | kthread+0xfc/0x184 | retfromfork+0x10/0x20 | SMP: stopping secondary CPUs | Kernel Offset: 0x57c5cb460000 from 0xffff800080000000 | PHYSOFFSET: 0x80000000 | CPU features: 0x00000000,1035b7a3,ccfe773f | Memory Limit: none | ---[ end Kernel panic - not syncing: HYP panic: | PS:a34023c9 PC:0000f250710b973c ESR:00000000f2000800 | FAR:ffff000800cb00d0 HPFAR:000000000880cb00 PAR:0000000000000000 | VCPU:0000000000000000 ]--- Fix it by checking for the successfull initialisation of kvmarminit() in finalize_pkvm() before proceeding any futher.