KVM: nVMX: Disable preemption while reading from shadow VMCS

In order to access the shadow VMCS, we need to load it. At this point, vmx->loaded_vmcs->vmcs and the actually loaded one start to differ. If we now get preempted by Linux, vmx_vcpu_put and, on return, the vmx_vcpu_load will work against the wrong vmcs. That can cause copy_shadow_to_vmcs12 to corrupt the vmcs12 state. Fix the issue by disabling preemption during the copy operation. copy_vmcs12_to_shadow is safe from this issue as it is executed by vmx_vcpu_run when preemption is already disabled before vmentry. This bug is exposed by running Jailhouse within KVM on CPUs with shadow VMCS support. Jailhouse never expects an interrupt pending vmexit, but the bug can cause it if, after copy_shadow_to_vmcs12 is preempted, the active VMCS happens to have the virtual interrupt pending flag set in the CPU-based execution controls. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

KVM: nVMX: Disable preemption while reading from shadow VMCS
In order to access the shadow VMCS, we need to load it. At this point, vmx->loaded_vmcs->vmcs and the actually loaded one start to differ. If we now get preempted by Linux, vmx_vcpu_put and, on return, the vmx_vcpu_load will work against the wrong vmcs. That can cause copy_shadow_to_vmcs12 to corrupt the vmcs12 state. Fix the issue by disabling preemption during the copy operation. copy_vmcs12_to_shadow is safe from this issue as it is executed by vmx_vcpu_run when preemption is already disabled before vmentry. This bug is exposed by running Jailhouse within KVM on CPUs with shadow VMCS support. Jailhouse never expects an interrupt pending vmexit, but the bug can cause it if, after copy_shadow_to_vmcs12 is preempted, the active VMCS happens to have the virtual interrupt pending flag set in the CPU-based execution controls. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Jan Kiszka · Paolo Bonzini
1 parent 7e46dddd6f
Showing 1 changed file with 4 additions and 0 deletions Side-by-side Diff
arch/x86/kvm/vmx.c
@@ -6426,6 +6426,8 @@
 	const unsigned long *fields = shadow_read_write_fields;
 	const int num_fields = max_shadow_read_write_fields;
  
+	preempt_disable();
+
 	vmcs_load(shadow_vmcs);
  
 	for (i = 0; i < num_fields; i++) {
@@ -6449,6 +6451,8 @@
  
 	vmcs_clear(shadow_vmcs);
 	vmcs_load(vmx->loaded_vmcs->vmcs);
+
+	preempt_enable();
 }
  
 static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)
...	...	@@ -6426,6 +6426,8 @@
6426	6426	const unsigned long *fields = shadow_read_write_fields;
6427	6427	const int num_fields = max_shadow_read_write_fields;
6428	6428
	6429	+ preempt_disable();
	6430	+
6429	6431	vmcs_load(shadow_vmcs);
6430	6432
6431	6433	for (i = 0; i < num_fields; i++) {
...	...	@@ -6449,6 +6451,8 @@
6449	6451
6450	6452	vmcs_clear(shadow_vmcs);
6451	6453	vmcs_load(vmx->loaded_vmcs->vmcs);
	6454	+
	6455	+ preempt_enable();
6452	6456	}
6453	6457
6454	6458	static void copy_vmcs12_to_shadow(struct vcpu_vmx *vmx)