diff options
| author | Boris Ostrovsky <boris.ostrovsky@oracle.com> | 2019-12-05 03:45:32 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-11 04:35:40 -0800 |
| commit | d71eef9fcc0b81fd56e59afd305a215d81239894 (patch) | |
| tree | fcda208cdbde6e7723eb46bb101638cbb07f8bfc /virt | |
| parent | a3db2949904b81ae53a840d99f71021f02a01fd3 (diff) | |
x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
commit b043138246a41064527cf019a3d51d9f015e9796 upstream.
There is a potential race in record_steal_time() between setting
host-local vcpu->arch.st.steal.preempted to zero (i.e. clearing
KVM_VCPU_PREEMPTED) and propagating this value to the guest with
kvm_write_guest_cached(). Between those two events the guest may
still see KVM_VCPU_PREEMPTED in its copy of kvm_steal_time, set
KVM_VCPU_FLUSH_TLB and assume that hypervisor will do the right
thing. Which it won't.
Instad of copying, we should map kvm_steal_time and that will
guarantee atomicity of accesses to @preempted.
This is part of CVE-2019-3016.
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'virt')
0 files changed, 0 insertions, 0 deletions