• Jan Kiszka's avatar
    KVM: nVMX: Disable preemption while reading from shadow VMCS · 282da870
    Jan Kiszka authored
    In order to access the shadow VMCS, we need to load it. At this point,
    vmx->loaded_vmcs->vmcs and the actually loaded one start to differ. If
    we now get preempted by Linux, vmx_vcpu_put and, on return, the
    vmx_vcpu_load will work against the wrong vmcs. That can cause
    copy_shadow_to_vmcs12 to corrupt the vmcs12 state.
    
    Fix the issue by disabling preemption during the copy operation.
    copy_vmcs12_to_shadow is safe from this issue as it is executed by
    vmx_vcpu_run when preemption is already disabled before vmentry.
    
    This bug is exposed by running Jailhouse within KVM on CPUs with
    shadow VMCS support.  Jailhouse never expects an interrupt pending
    vmexit, but the bug can cause it if, after copy_shadow_to_vmcs12
    is preempted, the active VMCS happens to have the virtual interrupt
    pending flag set in the CPU-based execution controls.
    Signed-off-by: default avatarJan Kiszka <jan.kiszka@siemens.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    282da870
vmx.c 263 KB