• David Matlack's avatar
    kvm: x86: fix stale mmio cache bug · 56f17dd3
    David Matlack authored
    The following events can lead to an incorrect KVM_EXIT_MMIO bubbling
    up to userspace:
    
    (1) Guest accesses gpa X without a memory slot. The gfn is cached in
    struct kvm_vcpu_arch (mmio_gfn). On Intel EPT-enabled hosts, KVM sets
    the SPTE write-execute-noread so that future accesses cause
    EPT_MISCONFIGs.
    
    (2) Host userspace creates a memory slot via KVM_SET_USER_MEMORY_REGION
    covering the page just accessed.
    
    (3) Guest attempts to read or write to gpa X again. On Intel, this
    generates an EPT_MISCONFIG. The memory slot generation number that
    was incremented in (2) would normally take care of this but we fast
    path mmio faults through quickly_check_mmio_pf(), which only checks
    the per-vcpu mmio cache. Since we hit the cache, KVM passes a
    KVM_EXIT_MMIO up to userspace.
    
    This patch fixes the issue by using the memslot generation number
    to validate the mmio cache.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarDavid Matlack <dmatlack@google.com>
    [xiaoguangrong: adjust the code to make it simpler for stable-tree fix.]
    Signed-off-by: default avatarXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Reviewed-by: default avatarDavid Matlack <dmatlack@google.com>
    Reviewed-by: default avatarXiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
    Tested-by: default avatarDavid Matlack <dmatlack@google.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    56f17dd3
mmu.c 113 KB