lkml.org 
[lkml]   [2021]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 01/11] KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB
    Date
    From: Sean Christopherson <seanjc@google.com>

    [ Upstream commit 179c6c27bf487273652efc99acd3ba512a23c137 ]

    Use the raw ASID, not ASID-1, when nullifying the last used VMCB when
    freeing an SEV ASID. The consumer, pre_sev_run(), indexes the array by
    the raw ASID, thus KVM could get a false negative when checking for a
    different VMCB if KVM manages to reallocate the same ASID+VMCB combo for
    a new VM.

    Note, this cannot cause a functional issue _in the current code_, as
    pre_sev_run() also checks which pCPU last did VMRUN for the vCPU, and
    last_vmentry_cpu is initialized to -1 during vCPU creation, i.e. is
    guaranteed to mismatch on the first VMRUN. However, prior to commit
    8a14fe4f0c54 ("kvm: x86: Move last_cpu into kvm_vcpu_arch as
    last_vmentry_cpu"), SVM tracked pCPU on its own and zero-initialized the
    last_cpu variable. Thus it's theoretically possible that older versions
    of KVM could miss a TLB flush if the first VMRUN is on pCPU0 and the ASID
    and VMCB exactly match those of a prior VM.

    Fixes: 70cd94e60c73 ("KVM: SVM: VMRUN should use associated ASID when SEV is enabled")
    Cc: Tom Lendacky <thomas.lendacky@amd.com>
    Cc: Brijesh Singh <brijesh.singh@amd.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/kvm/svm.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
    index bd463d684237..72d729f34437 100644
    --- a/arch/x86/kvm/svm.c
    +++ b/arch/x86/kvm/svm.c
    @@ -1780,7 +1780,7 @@ static void __sev_asid_free(int asid)

    for_each_possible_cpu(cpu) {
    sd = per_cpu(svm_data, cpu);
    - sd->sev_vmcbs[pos] = NULL;
    + sd->sev_vmcbs[asid] = NULL;
    }
    }

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-08-13 17:16    [W:4.178 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site