[PATCH] VMX: make vmx_read_guest_msr() cope with callers not checking its return value

[PATCH] VMX: make vmx_read_guest_msr() cope with callers not checking its return value

[Jan Beulich]

It took till the 4.5 backports of the L1TF prereqs that gcc 8.2 finally
noticed that the vPMU callers, not checking the function's return value,
may consume uninitialized data. Guard against this by storing zero on
the error path.

Signed-off-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/include/asm-x86/hvm/vmx/vmcs.h
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h
@@ -586,7 +586,10 @@ static inline int vmx_read_guest_msr(con
     const struct vmx_msr_entry *ent = vmx_find_msr(v, msr, VMX_MSR_GUEST);
 
     if ( !ent )
+    {
+        *val = 0;
         return -ESRCH;
+    }
 
     *val = ent->data;
 



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH] VMX: make vmx_read_guest_msr() cope with callers not checking its return value

[Andrew Cooper]

On 15/08/18 12:34, Jan Beulich wrote:
> It took till the 4.5 backports of the L1TF prereqs that gcc 8.2 finally
> noticed that the vPMU callers, not checking the function's return value,
> may consume uninitialized data. Guard against this by storing zero on
> the error path.
>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

vPMU really is the gift which keeps on giving...

>
> --- a/xen/include/asm-x86/hvm/vmx/vmcs.h
> +++ b/xen/include/asm-x86/hvm/vmx/vmcs.h
> @@ -586,7 +586,10 @@ static inline int vmx_read_guest_msr(con
>      const struct vmx_msr_entry *ent = vmx_find_msr(v, msr, VMX_MSR_GUEST);
>  
>      if ( !ent )
> +    {
> +        *val = 0;
>          return -ESRCH;
> +    }
>  
>      *val = ent->data;
>  

You want a similar adjustment in vmx_read_guest_loadonly_msr()
immediately below, which I believe is only applicable to staging atm.

With that, Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH] VMX: make vmx_read_guest_msr() cope with callers not checking its return value

[Jan Beulich]

>>> On 15.08.18 at 13:39, <andrew.cooper3@citrix.com> wrote:
> On 15/08/18 12:34, Jan Beulich wrote:
>> It took till the 4.5 backports of the L1TF prereqs that gcc 8.2 finally
>> noticed that the vPMU callers, not checking the function's return value,
>> may consume uninitialized data. Guard against this by storing zero on
>> the error path.
>>
>> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 
> vPMU really is the gift which keeps on giving...
> 
>>
>> --- a/xen/include/asm-x86/hvm/vmx/vmcs.h
>> +++ b/xen/include/asm-x86/hvm/vmx/vmcs.h
>> @@ -586,7 +586,10 @@ static inline int vmx_read_guest_msr(con
>>      const struct vmx_msr_entry *ent = vmx_find_msr(v, msr, VMX_MSR_GUEST);
>>  
>>      if ( !ent )
>> +    {
>> +        *val = 0;
>>          return -ESRCH;
>> +    }
>>  
>>      *val = ent->data;
>>  
> 
> You want a similar adjustment in vmx_read_guest_loadonly_msr()
> immediately below, which I believe is only applicable to staging atm.

Oh, indeed - coming from 4.5 I didn't pay enough attention here.

> With that, Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

Thanks, Jan



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH] VMX: make vmx_read_guest_msr() cope with callers not checking its return value

[Tian, Kevin]

> From: Jan Beulich [mailto:JBeulich@suse.com]
> Sent: Wednesday, August 15, 2018 7:34 PM
> 
> It took till the 4.5 backports of the L1TF prereqs that gcc 8.2 finally
> noticed that the vPMU callers, not checking the function's return value,
> may consume uninitialized data. Guard against this by storing zero on
> the error path.
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 

Acked-by: Kevin Tian <kevin.tian@intel.com>

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel