lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 10 Feb 2022 17:33:21 +0100 From: Paolo Bonzini <pbonzini@...hat.com> To: Sasha Levin <sashal@...nel.org>, linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Sean Christopherson <seanjc@...gle.com>, tglx@...utronix.de, mingo@...hat.com, bp@...en8.de, dave.hansen@...ux.intel.com, x86@...nel.org, kvm@...r.kernel.org Subject: Re: [PATCH MANUALSEL 5.16 4/8] KVM: nVMX: WARN on any attempt to allocate shadow VMCS for vmcs02 On 2/9/22 19:56, Sasha Levin wrote: > From: Sean Christopherson <seanjc@...gle.com> > > [ Upstream commit d6e656cd266cdcc95abd372c7faef05bee271d1a ] > > WARN if KVM attempts to allocate a shadow VMCS for vmcs02. KVM emulates > VMCS shadowing but doesn't virtualize it, i.e. KVM should never allocate > a "real" shadow VMCS for L2. > > The previous code WARNed but continued anyway with the allocation, > presumably in an attempt to avoid NULL pointer dereference. > However, alloc_vmcs (and hence alloc_shadow_vmcs) can fail, and > indeed the sole caller does: > > if (enable_shadow_vmcs && !alloc_shadow_vmcs(vcpu)) > goto out_shadow_vmcs; > > which makes it not a useful attempt. > > Signed-off-by: Sean Christopherson <seanjc@...gle.com> > Message-Id: <20220125220527.2093146-1-seanjc@...gle.com> > Signed-off-by: Paolo Bonzini <pbonzini@...hat.com> > Signed-off-by: Sasha Levin <sashal@...nel.org> > --- > arch/x86/kvm/vmx/nested.c | 22 ++++++++++++---------- > 1 file changed, 12 insertions(+), 10 deletions(-) > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c > index c605c2c01394b..9cd68e1fcf602 100644 > --- a/arch/x86/kvm/vmx/nested.c > +++ b/arch/x86/kvm/vmx/nested.c > @@ -4827,18 +4827,20 @@ static struct vmcs *alloc_shadow_vmcs(struct kvm_vcpu *vcpu) > struct loaded_vmcs *loaded_vmcs = vmx->loaded_vmcs; > > /* > - * We should allocate a shadow vmcs for vmcs01 only when L1 > - * executes VMXON and free it when L1 executes VMXOFF. > - * As it is invalid to execute VMXON twice, we shouldn't reach > - * here when vmcs01 already have an allocated shadow vmcs. > + * KVM allocates a shadow VMCS only when L1 executes VMXON and frees it > + * when L1 executes VMXOFF or the vCPU is forced out of nested > + * operation. VMXON faults if the CPU is already post-VMXON, so it > + * should be impossible to already have an allocated shadow VMCS. KVM > + * doesn't support virtualization of VMCS shadowing, so vmcs01 should > + * always be the loaded VMCS. > */ > - WARN_ON(loaded_vmcs == &vmx->vmcs01 && loaded_vmcs->shadow_vmcs); > + if (WARN_ON(loaded_vmcs != &vmx->vmcs01 || loaded_vmcs->shadow_vmcs)) > + return loaded_vmcs->shadow_vmcs; > + > + loaded_vmcs->shadow_vmcs = alloc_vmcs(true); > + if (loaded_vmcs->shadow_vmcs) > + vmcs_clear(loaded_vmcs->shadow_vmcs); > > - if (!loaded_vmcs->shadow_vmcs) { > - loaded_vmcs->shadow_vmcs = alloc_vmcs(true); > - if (loaded_vmcs->shadow_vmcs) > - vmcs_clear(loaded_vmcs->shadow_vmcs); > - } > return loaded_vmcs->shadow_vmcs; > } > NACK, it's just extra care but not particularly useful. Paolo
Powered by blists - more mailing lists