Skip to contentSkip to conversation

FAILED: patch "[PATCH] KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX" failed to apply to 4.14-stable tree

PATCH [email protected] 2 participants 2 messages Feb 9, 2020

Subsystems (3)
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From f958bd2314d117f8c29f4821401bc1925bc2e5ef Mon Sep 17 00:00:00 2001
From: Sean Christopherson <[email protected]>
Date: Mon, 9 Dec 2019 12:19:31 -0800
Subject: [PATCH] KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX
platform

Unlike most state managed by XSAVE, MPX is initialized to zero on INIT. Because INITs are usually recognized in the context of a VCPU_RUN call, kvm_vcpu_reset() puts the guest's FPU so that the FPU state is resident in memory, zeros the MPX state, and reloads FPU state to hardware. But, in the unlikely event that an INIT is recognized during kvm_arch_vcpu_ioctl_get_mpstate() via kvm_apic_accept_events(), kvm_vcpu_reset() will call kvm_put_guest_fpu() without a preceding kvm_load_guest_fpu() and corrupt the guest's FPU state (and possibly userspace's FPU state as well).

Given that MPX is being removed from the kernel[*], fix the bug with the simple-but-ugly approach of loading the guest's FPU during KVM_GET_MP_STATE.

[*] See commit f240652b6032b ("x86/mpx: Remove MPX APIs").

Fixes f775b13eedee2 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
arch/x86/kvm/x86.c +4 -0
index 3051324f72d3..0af5cb637bea 100644
@@ -8714,6 +8714,8 @@ int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
 				    struct kvm_mp_state *mp_state)
 {
 	vcpu_load(vcpu);
+	if (kvm_mpx_supported())
+		kvm_load_guest_fpu(vcpu);
 
 	kvm_apic_accept_events(vcpu);
 	if (vcpu->arch.mp_state == KVM_MP_STATE_HALTED &&
@@ -8722,6 +8724,8 @@ int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu,
 	else
 		mp_state->mp_state = vcpu->arch.mp_state;
 
+	if (kvm_mpx_supported())
+		kvm_put_guest_fpu(vcpu);
 	vcpu_put(vcpu);
 	return 0;
 }
maintainer
#1 lore raw
Quoted 32 lines · On Sun, Feb 09, 2020 at 01:22:44PM +0100, [email protected] wrote:

The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From f958bd2314d117f8c29f4821401bc1925bc2e5ef Mon Sep 17 00:00:00 2001
From: Sean Christopherson <[email protected]>
Date: Mon, 9 Dec 2019 12:19:31 -0800
Subject: [PATCH] KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform

Unlike most state managed by XSAVE, MPX is initialized to zero on INIT. Because INITs are usually recognized in the context of a VCPU_RUN call, kvm_vcpu_reset() puts the guest's FPU so that the FPU state is resident in memory, zeros the MPX state, and reloads FPU state to hardware. But, in the unlikely event that an INIT is recognized during kvm_arch_vcpu_ioctl_get_mpstate() via kvm_apic_accept_events(), kvm_vcpu_reset() will call kvm_put_guest_fpu() without a preceding kvm_load_guest_fpu() and corrupt the guest's FPU state (and possibly userspace's FPU state as well).

Given that MPX is being removed from the kernel[*], fix the bug with the simple-but-ugly approach of loading the guest's FPU during KVM_GET_MP_STATE.

Quoted 6 lines

[*] See commit f240652b6032b ("x86/mpx: Remove MPX APIs").

Fixes f775b13eedee2 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")

The conflict is because we didn't have fd2325612c14 ("KVM: Move vcpu_load to arch-specific kvm_arch_vcpu_ioctl_get_mpstate") on older kernels. I've fixed it and queued for 4.14.

Signature · 2 lines
Thanks,
Sasha