linux-kernel - Re: Re: [PATCH] KVM/nSVM: properly map nested VMCB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 10 Aug 2019 20:35:11 +0200
From:   Jiri Palecek <jpalecek@....de>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>, kvm@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org,
        Radim Krčmář <rkrcmar@...hat.com>,
        Joerg Roedel <joro@...tes.org>,
        KarimAllah Ahmed <karahmed@...zon.de>
Subject: Re: Re: [PATCH] KVM/nSVM: properly map nested VMCB

Hello,

On 04. 06. 19 19:27, Paolo Bonzini wrote:
> On 04/06/19 18:09, Vitaly Kuznetsov wrote:
>> Commit 8c5fbf1a7231 ("KVM/nSVM: Use the new mapping API for mapping guest
>> memory") broke nested SVM completely: kvm_vcpu_map()'s second parameter is
>> GFN so vmcb_gpa needs to be converted with gpa_to_gfn(), not the other way
>> around.
>>
>> Fixes: 8c5fbf1a7231 ("KVM/nSVM: Use the new mapping API for mapping guest memory")
>> Signed-off-by: Vitaly Kuznetsov <vkuznets@...hat.com>
>> ---
>>   arch/x86/kvm/svm.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
>> index 735b8c01895e..5beca1030c9a 100644
>> --- a/arch/x86/kvm/svm.c
>> +++ b/arch/x86/kvm/svm.c
>> @@ -3293,7 +3293,7 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
>>   				       vmcb->control.exit_int_info_err,
>>   				       KVM_ISA_SVM);
>>
>> -	rc = kvm_vcpu_map(&svm->vcpu, gfn_to_gpa(svm->nested.vmcb), &map);
>> +	rc = kvm_vcpu_map(&svm->vcpu, gpa_to_gfn(svm->nested.vmcb), &map);
>>   	if (rc) {
>>   		if (rc == -EINVAL)
>>   			kvm_inject_gp(&svm->vcpu, 0);
>> @@ -3583,7 +3583,7 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm)
>>
>>   	vmcb_gpa = svm->vmcb->save.rax;
>>
>> -	rc = kvm_vcpu_map(&svm->vcpu, gfn_to_gpa(vmcb_gpa), &map);
>> +	rc = kvm_vcpu_map(&svm->vcpu, gpa_to_gfn(vmcb_gpa), &map);
>>   	if (rc) {
>>   		if (rc == -EINVAL)
>>   			kvm_inject_gp(&svm->vcpu, 0);
>>
> Oops.  Queued, thanks.

Given that this fix didn't make it to 5.2, and its straightforwardness,
could you send it to stable for inclusion?

Regards

     Jiri Palecek