linux-kernel - Re: [PATCH 4.19 STABLE 2/2] KVM: VMX: Mark RCX, RDX and RSI as clobbered in vmx_vcpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200505061502.GA3874653@kroah.com>
Date:   Tue, 5 May 2020 08:15:02 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Sean Christopherson <sean.j.christopherson@...el.com>
Cc:     stable@...r.kernel.org,
        Ben Hutchings <ben.hutchings@...ethink.co.uk>,
        Sasha Levin <sashal@...nel.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        linux-kernel@...r.kernel.org,
        Tobias Urdin <tobias.urdin@...ero.com>
Subject: Re: [PATCH 4.19 STABLE 2/2] KVM: VMX: Mark RCX, RDX and RSI as
 clobbered in vmx_vcpu_run()'s asm blob

On Mon, May 04, 2020 at 06:23:48PM -0700, Sean Christopherson wrote:
> Save RCX, RDX and RSI to fake outputs to coerce the compiler into
> treating them as clobbered.  RCX in particular is likely to be reused by
> the compiler to dereference the 'struct vcpu_vmx' pointer, which will
> result in a null pointer dereference now that RCX is zeroed by the asm
> blob.
> 
> Add ASM_CALL_CONSTRAINT to fudge around an issue where <something>
> during modpost can't find vmx_return when specifying output constraints.
> 
> Reported-by: Tobias Urdin <tobias.urdin@...ero.com>
> Fixes: b4be98039a92 ("KVM: VMX: Zero out *all* general purpose registers after VM-Exit")
> Signed-off-by: Sean Christopherson <sean.j.christopherson@...el.com>
> ---
>  arch/x86/kvm/vmx.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 5b06a98ffd4c..54c8b4dc750d 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -10882,7 +10882,8 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
>  		".global vmx_return \n\t"
>  		"vmx_return: " _ASM_PTR " 2b \n\t"
>  		".popsection"
> -	      : : "c"(vmx), "d"((unsigned long)HOST_RSP), "S"(evmcs_rsp),
> +	      : ASM_CALL_CONSTRAINT, "=c"((int){0}), "=d"((int){0}), "=S"((int){0})
> +	      : "c"(vmx), "d"((unsigned long)HOST_RSP), "S"(evmcs_rsp),
>  		[launched]"i"(offsetof(struct vcpu_vmx, __launched)),
>  		[fail]"i"(offsetof(struct vcpu_vmx, fail)),
>  		[host_rsp]"i"(offsetof(struct vcpu_vmx, host_rsp)),
> -- 
> 2.26.0
> 

What is the git commit id of this patch in Linus's tree?

thanks,

greg k-h