• Sean Christopherson's avatar
    KVM: x86: Fix a 4.14 backport regression related to userspace/guest FPU · 9485d5d2
    Sean Christopherson authored
    Upstream commit:
    
        f775b13e ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
    
    introduced a bug, which was later fixed by upstream commit:
    
        5663d8f9 ("kvm: x86: fix WARN due to uninitialized guest FPU state")
    
    For reasons unknown, both commits were initially passed-over for
    inclusion in the 4.14 stable branch despite being tagged for stable.
    Eventually, someone noticed that the fixup, commit 5663d8f9, was
    missing from stable[1], and so it was queued up for 4.14 and included in
    release v4.14.79.
    
    Even later, the original buggy patch, commit f775b13e, was also
    applied to the 4.14 stable branch.  Through an unlucky coincidence, the
    incorrect ordering did not generate a conflict between the two patches,
    and led to v4.14.94 and later releases containing a spurious call to
    kvm_load_guest_fpu() in kvm_arch_vcpu_ioctl_run().  As a result, KVM may
    reload stale guest FPU state, e.g. after accepting in INIT event.  This
    can manifest as crashes during boot, segfaults, failed checksums and so
    on and so forth.
    
    Remove the unwanted kvm_{load,put}_guest_fpu() calls, i.e. make
    kvm_arch_vcpu_ioctl_run() look like commit 5663d8f9 was backported
    after commit f775b13e.
    
    [1] https://www.spinics.net/lists/stable/msg263931.html
    
    Fixes: 4124a4cf ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
    Cc: stable@vger.kernel.org
    Cc: Sasha Levin <sashal@kernel.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Peter Xu <peterx@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Radim Krčmář <rkrcmar@redhat.com>
    Reported-by: Roman Mamedov
    Reported-by: default avatarThomas Lindroth <thomas.lindroth@gmail.com>
    Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
    Acked-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    9485d5d2
x86.c 231 KB