| Message ID | 20190109172256.16711-1-vkuznets@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | x86/kvm/nVMX: don't skip emulated instruction twice when vmptr address is not backed | expand |
On Wed, Jan 09, 2019 at 06:22:56PM +0100, Vitaly Kuznetsov wrote: > Since commit 09abb5e3e5e50 ("KVM: nVMX: call kvm_skip_emulated_instruction > in nested_vmx_{fail,succeed}") nested_vmx_failValid() results in > kvm_skip_emulated_instruction() so doing it again in handle_vmptrld() when > vmptr address is not backed is wrong, we end up advancing RIP twice. > > Fixes: fca91f6d60b6e ("kvm: nVMX: Set VM instruction error for VMPTRLD of unbacked page") > Reported-by: Cornelia Huck <cohuck@redhat.com> > Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com> > --- > arch/x86/kvm/vmx/nested.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c > index 3170e291215d..2616bd2c7f2c 100644 > --- a/arch/x86/kvm/vmx/nested.c > +++ b/arch/x86/kvm/vmx/nested.c > @@ -4540,9 +4540,8 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu) > * given physical address won't match the required > * VMCS12_REVISION identifier. > */ > - nested_vmx_failValid(vcpu, > + return nested_vmx_failValid(vcpu, > VMXERR_VMPTRLD_INCORRECT_VMCS_REVISION_ID); > - return kvm_skip_emulated_instruction(vcpu); > } > new_vmcs12 = kmap(page); > if (new_vmcs12->hdr.revision_id != VMCS12_REVISION || > -- > 2.20.1 >
On Wed, 9 Jan 2019 18:22:56 +0100 Vitaly Kuznetsov <vkuznets@redhat.com> wrote: > Since commit 09abb5e3e5e50 ("KVM: nVMX: call kvm_skip_emulated_instruction > in nested_vmx_{fail,succeed}") nested_vmx_failValid() results in > kvm_skip_emulated_instruction() so doing it again in handle_vmptrld() when > vmptr address is not backed is wrong, we end up advancing RIP twice. > > Fixes: fca91f6d60b6e ("kvm: nVMX: Set VM instruction error for VMPTRLD of unbacked page") > Reported-by: Cornelia Huck <cohuck@redhat.com> > Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> > --- > arch/x86/kvm/vmx/nested.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c > index 3170e291215d..2616bd2c7f2c 100644 > --- a/arch/x86/kvm/vmx/nested.c > +++ b/arch/x86/kvm/vmx/nested.c > @@ -4540,9 +4540,8 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu) > * given physical address won't match the required > * VMCS12_REVISION identifier. > */ > - nested_vmx_failValid(vcpu, > + return nested_vmx_failValid(vcpu, > VMXERR_VMPTRLD_INCORRECT_VMCS_REVISION_ID); > - return kvm_skip_emulated_instruction(vcpu); > } > new_vmcs12 = kmap(page); > if (new_vmcs12->hdr.revision_id != VMCS12_REVISION || Not that I would be a nested vmx expert, but this looks correct. Reviewed-by: Cornelia Huck <cohuck@redhat.com>
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c index 3170e291215d..2616bd2c7f2c 100644 --- a/arch/x86/kvm/vmx/nested.c +++ b/arch/x86/kvm/vmx/nested.c @@ -4540,9 +4540,8 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu) * given physical address won't match the required * VMCS12_REVISION identifier. */ - nested_vmx_failValid(vcpu, + return nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_INCORRECT_VMCS_REVISION_ID); - return kvm_skip_emulated_instruction(vcpu); } new_vmcs12 = kmap(page); if (new_vmcs12->hdr.revision_id != VMCS12_REVISION ||
Since commit 09abb5e3e5e50 ("KVM: nVMX: call kvm_skip_emulated_instruction in nested_vmx_{fail,succeed}") nested_vmx_failValid() results in kvm_skip_emulated_instruction() so doing it again in handle_vmptrld() when vmptr address is not backed is wrong, we end up advancing RIP twice. Fixes: fca91f6d60b6e ("kvm: nVMX: Set VM instruction error for VMPTRLD of unbacked page") Reported-by: Cornelia Huck <cohuck@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> --- arch/x86/kvm/vmx/nested.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)