linux-kernel - Re: [PATCH 3.16 31/72] KVM: x86: Manually calculate reserved bits when loading PDPTRS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0e0b5aca785e41cdb0819820dfed1059683f5f58.camel@decadent.org.uk>
Date:   Tue, 10 Dec 2019 16:16:44 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     Sean Christopherson <sean.j.christopherson@...el.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        akpm@...ux-foundation.org, Denis Kirjanov <kda@...ux-powerpc.org>,
        Nadav Amit <nadav.amit@...il.com>,
        Doug Reiland <doug.reiland@...el.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Peter Xu <peterx@...hat.com>
Subject: Re: [PATCH 3.16 31/72] KVM: x86: Manually calculate reserved bits
 when loading PDPTRS

On Mon, 2019-12-09 at 07:49 -0800, Sean Christopherson wrote:
> On Sun, Dec 08, 2019 at 01:53:15PM +0000, Ben Hutchings wrote:
> > 3.16.79-rc1 review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Sean Christopherson <sean.j.christopherson@...el.com>
> > 
> > commit 16cfacc8085782dab8e365979356ce1ca87fd6cc upstream.
> 
> You'll also want to pull in two PAE related fixes (in this order):
> 
>   d35b34a9a70e ("kvm: mmu: Don't read PDPTEs when paging is not enabled")

I've added this, thanks.

>   bf03d4f93347 ("KVM: x86: introduce is_pae_paging")
>
> The "introduce is_pae_paging" has an undocumented bug fix.  IIRC it
> manifests as an unexpected #GP on MOV CR3 in 64-bit mode.  Here's the blurb
> I added to the backports for 4.x.
> 
>   Moving to the common helper also fixes a subtle bug in kvm_set_cr3()
>   where it fails to check is_long_mode() and results in KVM incorrectly
>   attempting to load PDPTRs for a 64-bit guest.

The 3.16, 4.4, and 4.9 branches have slightly different conditions in
kvm_set_cr3():

	if (is_long_mode(vcpu)) {
		if (cr3 & CR3_L_MODE_RESERVED_BITS)
			return 1;
	} else if (is_pae(vcpu) && is_paging(vcpu) &&
		   !load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3))
		return 1;

So load_pdptrs() already won't be called if is_long_mode() returns
true, and this fix shouldn't be needed.

Ben.

-- 
Ben Hutchings
Experience is directly proportional to the value of equipment destroyed
                                                    - Carolyn Scheppner



Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)