If a bit-pattern for the MSR-store address is so chosen that the
address is 16-bit aligned and is less than the processor's physical
width, but is a junk, VMENTRY ultimately fails even though we
pass the checks in check_vmentry_prereqs(). In such a case, the high bit
in "exit reason" will be set, denoting a VM-entry failure. But since we
call nested_vmx_store_msr() in nested_vmx_vmexit() without checking the
"exit reason", we may end up storing the MSRs at an undefined location in
memory thereby clobbering something else. This patch fixes the problem by
calling nested_vmx_store_msr() only when "exit reason" is not VM-entry
failure.
Reported-by: Krish Sadhukhan <krish.sadhukhan@xxxxxxxxxx>
Suggested-by: Jim Mattson <jmattson@xxxxxxxxxx>
Signed-off-by: Krish Sadhukhan <krish.sadhukhan@xxxxxxxxxx>
Reviewed-by: Darren Kenny <darren.kenny@xxxxxxxxxx>
---
arch/x86/kvm/vmx.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4555077..aecd461 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -13827,6 +13827,12 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
* L2 to IDT_VECTORING_INFO_FIELD.
*/
vmcs12_save_pending_event(vcpu, vmcs12);
+
+ if (nested_vmx_store_msr(vcpu,
+ vmcs12->vm_exit_msr_store_addr,
+ vmcs12->vm_exit_msr_store_count))
+ nested_vmx_abort(vcpu,
+ VMX_ABORT_SAVE_GUEST_MSR_FAIL);
}
/*
@@ -14159,10 +14165,6 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
* immutable.
*/
nested_flush_cached_shadow_vmcs12(vcpu, vmcs12);
-
- if (nested_vmx_store_msr(vcpu, vmcs12->vm_exit_msr_store_addr,
- vmcs12->vm_exit_msr_store_count))
- nested_vmx_abort(vcpu, VMX_ABORT_SAVE_GUEST_MSR_FAIL);
} else {
/*
* The only expected VM-instruction error is "VM entry with
--
2.9.5
