| Message ID | 20190130222926.120454-1-dverkamp@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2,for-4.14-stable] x86,kvm: remove extra kvm_{get,put}_guest_fpu | expand |
On Wed, Jan 30, 2019 at 2:29 PM Daniel Verkamp <dverkamp@chromium.org> wrote: > > Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out > to vcpu_run") applied a patch from upstream, but it appears that it > wasn't backported correctly to 4.14. The extra out_fpu label and > kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling > kvm_put_guest_fpu() twice in a row, corrupting guest state. > Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of > the function. > > Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run") > Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> > --- > > v2: removed additional redundant kvm_load_guest_fpu() > > I'm unsure if this is the right way to send this fix - there is no > corresponding mainline commit to reference, since the code there is > already correct, and the problem was introduced in the cherry-picked > stable backport. Please let me know if there's a different process for > fixes to stable-only issues. Please ignore this - I had checked last week and it seemed no-one had reported this, but now it looks like an identical fix was already posted: https://www.spinics.net/lists/stable/msg282163.html Sorry for the noise! Thanks, -- Daniel
On Wed, Jan 30, 2019 at 02:29:26PM -0800, Daniel Verkamp wrote: > Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out > to vcpu_run") applied a patch from upstream, but it appears that it > wasn't backported correctly to 4.14. The extra out_fpu label and > kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling > kvm_put_guest_fpu() twice in a row, corrupting guest state. > Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of > the function. > > Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run") > Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> > --- > > v2: removed additional redundant kvm_load_guest_fpu() > > I'm unsure if this is the right way to send this fix - there is no > corresponding mainline commit to reference, since the code there is > already correct, and the problem was introduced in the cherry-picked > stable backport. Please let me know if there's a different process for > fixes to stable-only issues. This should now be fixed with 9485d5d2318b ("KVM: x86: Fix a 4.14 backport regression related to userspace/guest FPU") in the 4.14.97 release that just happened, right? thanks, greg k-h
Yes, please disregard this patch - I had this on my to-do list to investigate and missed the stable update that fixed it already. Thanks, -- Daniel On Wed, Jan 30, 2019 at 11:18 PM Greg KH <gregkh@linuxfoundation.org> wrote: > > On Wed, Jan 30, 2019 at 02:29:26PM -0800, Daniel Verkamp wrote: > > Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out > > to vcpu_run") applied a patch from upstream, but it appears that it > > wasn't backported correctly to 4.14. The extra out_fpu label and > > kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling > > kvm_put_guest_fpu() twice in a row, corrupting guest state. > > Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of > > the function. > > > > Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run") > > Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> > > --- > > > > v2: removed additional redundant kvm_load_guest_fpu() > > > > I'm unsure if this is the right way to send this fix - there is no > > corresponding mainline commit to reference, since the code there is > > already correct, and the problem was introduced in the cherry-picked > > stable backport. Please let me know if there's a different process for > > fixes to stable-only issues. > > This should now be fixed with 9485d5d2318b ("KVM: x86: Fix a 4.14 > backport regression related to userspace/guest FPU") in the 4.14.97 > release that just happened, right? > > thanks, > > greg k-h
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 130be2efafbe..af7ab2c71786 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -7423,14 +7423,12 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) } } - kvm_load_guest_fpu(vcpu); - if (unlikely(vcpu->arch.complete_userspace_io)) { int (*cui)(struct kvm_vcpu *) = vcpu->arch.complete_userspace_io; vcpu->arch.complete_userspace_io = NULL; r = cui(vcpu); if (r <= 0) - goto out_fpu; + goto out; } else WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed); @@ -7439,8 +7437,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) else r = vcpu_run(vcpu); -out_fpu: - kvm_put_guest_fpu(vcpu); out: kvm_put_guest_fpu(vcpu); post_kvm_run_save(vcpu);
Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run") applied a patch from upstream, but it appears that it wasn't backported correctly to 4.14. The extra out_fpu label and kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling kvm_put_guest_fpu() twice in a row, corrupting guest state. Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of the function. Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run") Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> --- v2: removed additional redundant kvm_load_guest_fpu() I'm unsure if this is the right way to send this fix - there is no corresponding mainline commit to reference, since the code there is already correct, and the problem was introduced in the cherry-picked stable backport. Please let me know if there's a different process for fixes to stable-only issues. --- arch/x86/kvm/x86.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)