The following commit has been merged into the x86/seves branch of tip: Commit-ID: e6eb15c9ba3165698488ae5c34920eea20eaa38e Gitweb: https://git.kernel.org/tip/e6eb15c9ba3165698488ae5c34920eea20eaa38e Author: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx> AuthorDate: Mon, 14 Sep 2020 15:37:25 +02:00 Committer: Borislav Petkov <bp@xxxxxxx> CommitterDate: Mon, 14 Sep 2020 18:08:54 +02:00 KVM: nSVM: Avoid freeing uninitialized pointers in svm_set_nested_state() The save and ctl pointers are passed uninitialized to kfree() when svm_set_nested_state() follows the 'goto out_set_gif' path. While the issue could've been fixed by initializing these on-stack varialbles to NULL, it seems preferable to eliminate 'out_set_gif' label completely as it is not actually a failure path and duplicating a single svm_set_gif() call doesn't look too bad. [ bp: Drop obscure Addresses-Coverity: tag. ] Fixes: 6ccbd29ade0d ("KVM: SVM: nested: Don't allocate VMCB structures on stack") Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Reported-by: Joerg Roedel <jroedel@xxxxxxx> Reported-by: Colin King <colin.king@xxxxxxxxxxxxx> Signed-off-by: Vitaly Kuznetsov <vkuznets@xxxxxxxxxx> Signed-off-by: Borislav Petkov <bp@xxxxxxx> Reviewed-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx> Acked-by: Joerg Roedel <jroedel@xxxxxxx> Tested-by: Tom Lendacky <thomas.lendacky@xxxxxxx> Link: https://lkml.kernel.org/r/20200914133725.650221-1-vkuznets@xxxxxxxxxx --- arch/x86/kvm/svm/nested.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index 2803662..d1ae94f 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1092,7 +1092,8 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, if (!(kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE)) { svm_leave_nested(svm); - goto out_set_gif; + svm_set_gif(svm, !!(kvm_state->flags & KVM_STATE_NESTED_GIF_SET)); + return 0; } if (!page_address_valid(vcpu, kvm_state->hdr.svm.vmcb_pa)) @@ -1145,7 +1146,6 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu, load_nested_vmcb_control(svm, ctl); nested_prepare_vmcb_control(svm); -out_set_gif: svm_set_gif(svm, !!(kvm_state->flags & KVM_STATE_NESTED_GIF_SET)); ret = 0;
![]() |