Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out
to vcpu_run") applied a patch from upstream, but it appears that it
wasn't backported correctly to 4.14. The extra out_fpu label and
kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling
kvm_put_guest_fpu() twice in a row, corrupting guest state.
Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of
the function.
Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
Signed-off-by: Daniel Verkamp <dverkamp@xxxxxxxxxxxx>
---
v2: removed additional redundant kvm_load_guest_fpu()
I'm unsure if this is the right way to send this fix - there is no
corresponding mainline commit to reference, since the code there is
already correct, and the problem was introduced in the cherry-picked
stable backport. Please let me know if there's a different process for
fixes to stable-only issues.
---
arch/x86/kvm/x86.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 130be2efafbe..af7ab2c71786 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7423,14 +7423,12 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
}
}
- kvm_load_guest_fpu(vcpu);
-
if (unlikely(vcpu->arch.complete_userspace_io)) {
int (*cui)(struct kvm_vcpu *) = vcpu->arch.complete_userspace_io;
vcpu->arch.complete_userspace_io = NULL;
r = cui(vcpu);
if (r <= 0)
- goto out_fpu;
+ goto out;
} else
WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed);
@@ -7439,8 +7437,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
else
r = vcpu_run(vcpu);
-out_fpu:
- kvm_put_guest_fpu(vcpu);
out:
kvm_put_guest_fpu(vcpu);
post_kvm_run_save(vcpu);
--
2.20.1.495.gaa96b0ce6b-goog
