diff options
author | Boris Ostrovsky <boris.ostrovsky@oracle.com> | 2019-12-05 06:45:32 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-11 15:35:40 +0300 |
commit | d71eef9fcc0b81fd56e59afd305a215d81239894 (patch) | |
tree | fcda208cdbde6e7723eb46bb101638cbb07f8bfc /include | |
parent | a3db2949904b81ae53a840d99f71021f02a01fd3 (diff) | |
download | linux-d71eef9fcc0b81fd56e59afd305a215d81239894.tar.xz |
x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
commit b043138246a41064527cf019a3d51d9f015e9796 upstream.
There is a potential race in record_steal_time() between setting
host-local vcpu->arch.st.steal.preempted to zero (i.e. clearing
KVM_VCPU_PREEMPTED) and propagating this value to the guest with
kvm_write_guest_cached(). Between those two events the guest may
still see KVM_VCPU_PREEMPTED in its copy of kvm_steal_time, set
KVM_VCPU_FLUSH_TLB and assume that hypervisor will do the right
thing. Which it won't.
Instad of copying, we should map kvm_steal_time and that will
guarantee atomicity of accesses to @preempted.
This is part of CVE-2019-3016.
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions