| Message ID | 20211011143702.1786568-9-eesposit@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: nSVM: avoid TOC/TOU race when checking vmcb12 | expand |
On Mon, 2021-10-11 at 10:37 -0400, Emanuele Giuseppe Esposito wrote: > Just as in nested_vmcb_valid_sregs, we only need the vcpu param > to perform the checks on vmcb nested state, since we always > look at the cached fields. > > Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com> > --- > arch/x86/kvm/svm/nested.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c > index 13be1002ad1c..19bce3819cce 100644 > --- a/arch/x86/kvm/svm/nested.c > +++ b/arch/x86/kvm/svm/nested.c > @@ -209,9 +209,11 @@ static bool nested_svm_check_bitmap_pa(struct kvm_vcpu *vcpu, u64 pa, u32 size) > kvm_vcpu_is_legal_gpa(vcpu, addr + size - 1); > } > > -static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu, > - struct vmcb_ctrl_area_cached *control) > +static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu) > { > + struct vcpu_svm *svm = to_svm(vcpu); > + struct vmcb_ctrl_area_cached *control = &svm->nested.ctl; > + > if (CC(!vmcb12_is_intercept(control, INTERCEPT_VMRUN))) > return false; > > @@ -651,7 +653,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) > nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); > > if (!nested_vmcb_valid_sregs(vcpu) || > - !nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) { > + !nested_vmcb_check_controls(vcpu)) { > vmcb12->control.exit_code = SVM_EXIT_ERR; > vmcb12->control.exit_code_hi = 0; > vmcb12->control.exit_info_1 = 0; > @@ -1367,7 +1369,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, > > ret = -EINVAL; > nested_copy_vmcb_control_to_cache(svm, ctl); > - if (!nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) > + if (!nested_vmcb_check_controls(vcpu)) > goto out_free_ctl; > > /* Because of the issue I pointed out in patch 7, you probably want: static bool __nested_vmcb_check_controls(struct kvm_vcpu *vcpu, struct vmcb_ctrl_area_cached *control) { .... } static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu) { return __nested_vmcb_check_controls(vcpu, &svm->nested.ctl); } Same for nested_vmcb_valid_sregs (maybe you even want to rename it to nested_vmcb_check_save while at it?): static bool __nested_vmcb_check_save(struct kvm_vcpu *vcpu, struct vmcb_save_area_cached *save) { ... } static bool nested_vmcb_check_save(struct kvm_vcpu *vcpu) { return __nested_vmcb_check_save(vcpu, &svm->nested.save); } Best regards, Maxim Levitsky
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 13be1002ad1c..19bce3819cce 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -209,9 +209,11 @@ static bool nested_svm_check_bitmap_pa(struct kvm_vcpu *vcpu, u64 pa, u32 size) kvm_vcpu_is_legal_gpa(vcpu, addr + size - 1); } -static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu, - struct vmcb_ctrl_area_cached *control) +static bool nested_vmcb_check_controls(struct kvm_vcpu *vcpu) { + struct vcpu_svm *svm = to_svm(vcpu); + struct vmcb_ctrl_area_cached *control = &svm->nested.ctl; + if (CC(!vmcb12_is_intercept(control, INTERCEPT_VMRUN))) return false; @@ -651,7 +653,7 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); if (!nested_vmcb_valid_sregs(vcpu) || - !nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) { + !nested_vmcb_check_controls(vcpu)) { vmcb12->control.exit_code = SVM_EXIT_ERR; vmcb12->control.exit_code_hi = 0; vmcb12->control.exit_info_1 = 0; @@ -1367,7 +1369,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, ret = -EINVAL; nested_copy_vmcb_control_to_cache(svm, ctl); - if (!nested_vmcb_check_controls(vcpu, &svm->nested.ctl)) + if (!nested_vmcb_check_controls(vcpu)) goto out_free_ctl; /*
Just as in nested_vmcb_valid_sregs, we only need the vcpu param to perform the checks on vmcb nested state, since we always look at the cached fields. Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com> --- arch/x86/kvm/svm/nested.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)