openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

KVM: nVMX: Add a WARN for freeing a loaded VMCS02 

When attempting to free a loaded VMCS02, add a WARN and avoid
freeing it (to avoid use-after-free situations).

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Mark Kanda <mark.kanda@oracle.com>
Reviewed-by: Ameya More <ameya.more@oracle.com>
Reviewed-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
This commit is contained in:
Mark Kanda 2017-11-27 17:22:26 -06:00 committed by Paolo Bonzini
parent 00647b4494
commit 276c796cfe
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
arch/x86/kvm/vmx.c
View File

@ -3846,6 +3846,19 @@ static void free_loaded_vmcs(struct loaded_vmcs *loaded_vmcs)
WARN_ON(loaded_vmcs->shadow_vmcs != NULL); WARN_ON(loaded_vmcs->shadow_vmcs != NULL);
} }
static void vmx_nested_free_vmcs02(struct vcpu_vmx *vmx)
{
struct loaded_vmcs *loaded_vmcs = &vmx->nested.vmcs02;
/*
* Just leak the VMCS02 if the WARN triggers. Better than
* a use-after-free.
*/
if (WARN_ON(vmx->loaded_vmcs == loaded_vmcs))
return;
free_loaded_vmcs(loaded_vmcs);
}
static void free_kvm_area(void) static void free_kvm_area(void)
{ {
int cpu; int cpu;
@ -7203,7 +7216,7 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
free_page((unsigned long)vmx->nested.msr_bitmap); free_page((unsigned long)vmx->nested.msr_bitmap);
out_msr_bitmap: out_msr_bitmap:
free_loaded_vmcs(&vmx->nested.vmcs02); vmx_nested_free_vmcs02(vmx);
out_vmcs02: out_vmcs02:
return -ENOMEM; return -ENOMEM;
@ -7375,7 +7388,7 @@ static void free_nested(struct vcpu_vmx *vmx)
vmx->nested.pi_desc = NULL; vmx->nested.pi_desc = NULL;
} }
free_loaded_vmcs(&vmx->nested.vmcs02); vmx_nested_free_vmcs02(vmx);
} }
/* Emulate the VMXOFF instruction */ /* Emulate the VMXOFF instruction */