linux-kernel - Re: [PATCH] KVM/nSVM: properly map nested VMCB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9bade306-5229-5744-48f6-bab022cdf27b@redhat.com>
Date:   Wed, 14 Aug 2019 14:43:23 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Jiri Palecek <jpalecek@....de>,
        Vitaly Kuznetsov <vkuznets@...hat.com>, kvm@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org,
        Radim Krčmář <rkrcmar@...hat.com>,
        Joerg Roedel <joro@...tes.org>,
        KarimAllah Ahmed <karahmed@...zon.de>
Subject: Re: [PATCH] KVM/nSVM: properly map nested VMCB

On 10/08/19 20:35, Jiri Palecek wrote:
> Hello,
> 
> On 04. 06. 19 19:27, Paolo Bonzini wrote:
>> On 04/06/19 18:09, Vitaly Kuznetsov wrote:
>>> Commit 8c5fbf1a7231 ("KVM/nSVM: Use the new mapping API for mapping
>>> guest
>>> memory") broke nested SVM completely: kvm_vcpu_map()'s second
>>> parameter is
>>> GFN so vmcb_gpa needs to be converted with gpa_to_gfn(), not the
>>> other way
>>> around.
>>>
>>> Fixes: 8c5fbf1a7231 ("KVM/nSVM: Use the new mapping API for mapping
>>> guest memory")
>>> Signed-off-by: Vitaly Kuznetsov <vkuznets@...hat.com>
>>> ---
>>>   arch/x86/kvm/svm.c | 4 ++--
>>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
>>> index 735b8c01895e..5beca1030c9a 100644
>>> --- a/arch/x86/kvm/svm.c
>>> +++ b/arch/x86/kvm/svm.c
>>> @@ -3293,7 +3293,7 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
>>>                          vmcb->control.exit_int_info_err,
>>>                          KVM_ISA_SVM);
>>>
>>> -    rc = kvm_vcpu_map(&svm->vcpu, gfn_to_gpa(svm->nested.vmcb), &map);
>>> +    rc = kvm_vcpu_map(&svm->vcpu, gpa_to_gfn(svm->nested.vmcb), &map);
>>>       if (rc) {
>>>           if (rc == -EINVAL)
>>>               kvm_inject_gp(&svm->vcpu, 0);
>>> @@ -3583,7 +3583,7 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm)
>>>
>>>       vmcb_gpa = svm->vmcb->save.rax;
>>>
>>> -    rc = kvm_vcpu_map(&svm->vcpu, gfn_to_gpa(vmcb_gpa), &map);
>>> +    rc = kvm_vcpu_map(&svm->vcpu, gpa_to_gfn(vmcb_gpa), &map);
>>>       if (rc) {
>>>           if (rc == -EINVAL)
>>>               kvm_inject_gp(&svm->vcpu, 0);
>>>
>> Oops.  Queued, thanks.
> 
> Given that this fix didn't make it to 5.2, and its straightforwardness,
> could you send it to stable for inclusion?

Done, thanks for the reminder!

Paolo