Skip to contentSkip to conversation

KVM: nVMX: Trap unconditionally if msr bitmap access fails

PATCH Applied Jan Kiszka 3 participants 3 messages Feb 14, 2013 – Feb 19, 2013

Subsystems (3)
x86 KVM KVM x86
lore
Share & tools
lore

Jan Kiszka

author
#0 lore raw

PATCH 1/1 KVM: nVMX: Trap unconditionally if msr bitmap access fails

This avoids basing decisions on uninitialized variables, potentially leaking kernel data to the L1 guest.

Signed-off-by Jan Kiszka <[email protected]>
---
 arch/x86/kvm/vmx.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
arch/x86/kvm/vmx.c +2 -1
index 2633199..81a25de 100644
@@ -5991,7 +5991,8 @@ static bool nested_vmx_exit_handled_msr(struct kvm_vcpu *vcpu,
 	/* Then read the msr_index'th bit from this bitmap: */
 	if (msr_index < 1024*8) {
 		unsigned char b;
-		kvm_read_guest(vcpu->kvm, bitmap + msr_index/8, &b, 1);
+		if (kvm_read_guest(vcpu->kvm, bitmap + msr_index/8, &b, 1))
+			return 1;
 		return 1 & (b >> (msr_index & 7));
 	} else
 		return 1; /* let L1 handle the wrong parameter */
Signature · 1 line
1.7.3.4
Reviewed-by on v1 1/1
#1 lore raw
Quoted 4 lines · Jan Kiszka

This avoids basing decisions on uninitialized variables, potentially leaking kernel data to the L1 guest.

Signed-off-by Jan Kiszka <[email protected]>
Reviewed-by Gleb Natapov <[email protected]>
Quoted 20 lines
---
 arch/x86/kvm/vmx.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
arch/x86/kvm/vmx.c +2 -1
index 2633199..81a25de 100644
@@ -5991,7 +5991,8 @@ static bool nested_vmx_exit_handled_msr(struct kvm_vcpu *vcpu,
 	/* Then read the msr_index'th bit from this bitmap: */
 	if (msr_index < 1024*8) {
 		unsigned char b;
-		kvm_read_guest(vcpu->kvm, bitmap + msr_index/8, &b, 1);
+		if (kvm_read_guest(vcpu->kvm, bitmap + msr_index/8, &b, 1))
+			return 1;
 		return 1 & (b >> (msr_index & 7));
 	} else
 		return 1; /* let L1 handle the wrong parameter */
Signature · 1 line
1.7.3.4

--
Gleb.