From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <sean.j.christopherson@intel.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Dan Cross <dcross@google.com>, Peter Shier <pshier@google.com>
Subject: [PATCH 5/7] KVM: nVMX: Ensure vmcs01 is the loaded VMCS when freeing nested state
Date: Tue, 14 Jul 2020 21:05:55 -0700 [thread overview]
Message-ID: <20200715040557.5889-6-sean.j.christopherson@intel.com> (raw)
In-Reply-To: <20200715040557.5889-1-sean.j.christopherson@intel.com>
Add a WARN in free_nested() to ensure vmcs01 is loaded prior to freeing
vmcs02 and friends, and explicitly switch to vmcs01 if it's not. KVM is
supposed to keep is_guest_mode() and loaded_vmcs==vmcs02 synchronized,
but bugs happen and freeing vmcs02 while it's in use will escalate a KVM
error to a use-after-free and potentially crash the kernel.
Do the WARN and switch even in the !vmxon case to help detect latent
bugs. free_nested() is not a hot path, and the check is cheap.
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
---
arch/x86/kvm/vmx/nested.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index e9b27c6478da3..5734bff1a5907 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -279,6 +279,9 @@ static void free_nested(struct kvm_vcpu *vcpu)
{
struct vcpu_vmx *vmx = to_vmx(vcpu);
+ if (WARN_ON_ONCE(vmx->loaded_vmcs != &vmx->vmcs01))
+ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+
if (!vmx->nested.vmxon && !vmx->nested.smm.vmxon)
return;
--
2.26.0
next prev parent reply other threads:[~2020-07-15 4:06 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-15 4:05 [PATCH 0/7] KVM: nVMX: Bug fixes and cleanup Sean Christopherson
2020-07-15 4:05 ` [PATCH 1/7] KVM: nVMX: Reset the segment cache when stuffing guest segs Sean Christopherson
2020-07-15 4:05 ` [PATCH 2/7] KVM: nVMX: Reload vmcs01 if getting vmcs12's pages fails Sean Christopherson
2020-07-15 4:05 ` [PATCH 3/7] KVM: nVMX: Explicitly check for valid guest state for !unrestricted guest Sean Christopherson
2020-07-15 4:05 ` [PATCH 4/7] KVM: nVMX: Move free_nested() below vmx_switch_vmcs() Sean Christopherson
2020-07-15 4:05 ` Sean Christopherson [this message]
2020-07-15 4:05 ` [PATCH 6/7] KVM: nVMX: Drop redundant VMCS switch and free_nested() call Sean Christopherson
2020-07-15 4:05 ` [PATCH 7/7] KVM: nVMX: WARN on attempt to switch the currently loaded VMCS Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200715040557.5889-6-sean.j.christopherson@intel.com \
--to=sean.j.christopherson@intel.com \
--cc=dcross@google.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=pshier@google.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.