All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jim Mattson <jmattson@google.com>
To: kvm list <kvm@vger.kernel.org>, Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH 00/12] KVM: nVMX: Fix vmcs02 PID use-after-free issue
Date: Fri, 21 May 2021 05:04:35 -0700	[thread overview]
Message-ID: <CALMp9eTSTCD3gjdFv3WtjLdFoKshq0+69xeoQkTGxhGmYn2-sA@mail.gmail.com> (raw)
In-Reply-To: <20210520230339.267445-1-jmattson@google.com>

On Thu, May 20, 2021 at 4:03 PM Jim Mattson <jmattson@google.com> wrote:
>
> When the VMCS12 posted interrupt descriptor isn't backed by an L1
> memslot, kvm will launch vmcs02 with a stale posted interrupt
> descriptor. Before commit 6beb7bd52e48 ("kvm: nVMX: Refactor
> nested_get_vmcs12_pages()"), kvm would have silently disabled the
> VMCS02 "process posted interrupts" VM-execution control. Both
> behaviors are wrong, though the use-after-free is more egregious.

Oops. Prior to the referenced commit, kvm would have forced a vmcs02
VM-entry failure by loading an illegal value into its posted interrupt
descriptor field. Though better than clearing the "process posted
interrupts" VM-execution control, that's still wrong.

  parent reply	other threads:[~2021-05-21 12:04 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-20 23:03 [PATCH 00/12] KVM: nVMX: Fix vmcs02 PID use-after-free issue Jim Mattson
2021-05-20 23:03 ` [PATCH 01/12] KVM: x86: Remove guest mode check from kvm_check_nested_events Jim Mattson
2021-05-20 23:03 ` [PATCH 02/12] KVM: x86: Wake up a vCPU when kvm_check_nested_events fails Jim Mattson
2021-05-24 15:43   ` Paolo Bonzini
2021-05-24 16:39     ` Jim Mattson
2021-05-24 16:43       ` Paolo Bonzini
2021-05-24 17:10         ` Jim Mattson
2021-05-24 23:10         ` Sean Christopherson
2021-05-24 23:23           ` Jim Mattson
2021-05-24 23:24             ` Sean Christopherson
2021-05-24 23:29               ` Jim Mattson
2021-05-24 23:34                 ` Sean Christopherson
2021-05-20 23:03 ` [PATCH 03/12] KVM: nVMX: Add a return code to vmx_complete_nested_posted_interrupt Jim Mattson
2021-05-20 23:03 ` [PATCH 04/12] KVM: x86: Add a return code to inject_pending_event Jim Mattson
2021-05-20 23:03 ` [PATCH 05/12] KVM: x86: Add a return code to kvm_apic_accept_events Jim Mattson
2021-05-25 19:24   ` Reiji Watanabe
2021-05-25 20:35     ` Jim Mattson
2021-05-20 23:03 ` [PATCH 06/12] KVM: nVMX: Fail on MMIO completion for nested posted interrupts Jim Mattson
2021-05-20 23:03 ` [PATCH 07/12] KVM: nVMX: Disable vmcs02 posted interrupts if vmcs12 PID isn't mappable Jim Mattson
2021-05-24 23:21   ` Sean Christopherson
2021-05-24 23:27     ` Jim Mattson
2021-05-24 23:45       ` Sean Christopherson
2021-05-25  0:03         ` Jim Mattson
2021-05-25  0:11           ` Sean Christopherson
2021-05-25  0:15             ` Jim Mattson
2021-05-25  0:57               ` Sean Christopherson
2021-05-20 23:03 ` [PATCH 08/12] KVM: selftests: Move APIC definitions into a separate file Jim Mattson
2021-05-20 23:03 ` [PATCH 09/12] KVM: selftests: Hoist APIC functions out of individual tests Jim Mattson
2021-05-20 23:03 ` [PATCH 10/12] KVM: selftests: Introduce x2APIC register manipulation functions Jim Mattson
2021-05-20 23:03 ` [PATCH 11/12] KVM: selftests: Introduce prepare_tpr_shadow Jim Mattson
2021-05-20 23:03 ` [PATCH 12/12] KVM: selftests: Add a test of an unbacked nested PI descriptor Jim Mattson
2021-05-21  0:58 ` [PATCH 00/12] KVM: nVMX: Fix vmcs02 PID use-after-free issue Sean Christopherson
2021-05-21 12:04 ` Jim Mattson [this message]
2021-05-24 15:50 ` Paolo Bonzini
2021-05-24 16:46 ` Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CALMp9eTSTCD3gjdFv3WtjLdFoKshq0+69xeoQkTGxhGmYn2-sA@mail.gmail.com \
    --to=jmattson@google.com \
    --cc=kvm@vger.kernel.org \
    --cc=pbonzini@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.