Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-13 Thread Paolo Bonzini
On 13/09/19 01:52, Sean Christopherson wrote: >>> >> Perhaps you could also add a comment like the one Paolo added when he >> made the same change in kvm_read_guest_virt? >> See commit 353c0956a618 ("KVM: x86: work around leak of uninitialized >> stack contents (CVE-2019-7222)"). > I have a better

Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-12 Thread Sean Christopherson
On Thu, Sep 12, 2019 at 02:20:09PM -0700, Jim Mattson wrote: > On Wed, Sep 11, 2019 at 9:18 PM Fuqian Huang wrote: > > > > Emulation of VMPTRST can incorrectly inject a page fault > > when passed an operand that points to an MMIO address. > > The page fault will use uninitialized kernel stack memo

Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-12 Thread Jim Mattson
On Wed, Sep 11, 2019 at 9:18 PM Fuqian Huang wrote: > > Emulation of VMPTRST can incorrectly inject a page fault > when passed an operand that points to an MMIO address. > The page fault will use uninitialized kernel stack memory > as the CR2 and error code. > > The right behavior would be to abor

Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-12 Thread Vitaly Kuznetsov
Jim Mattson writes: > On Thu, Sep 12, 2019 at 1:51 AM Vitaly Kuznetsov wrote: >> >> Fuqian Huang writes: >> >> > Emulation of VMPTRST can incorrectly inject a page fault >> > when passed an operand that points to an MMIO address. >> > The page fault will use uninitialized kernel stack memory >>

Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-12 Thread Jim Mattson
On Thu, Sep 12, 2019 at 1:51 AM Vitaly Kuznetsov wrote: > > Fuqian Huang writes: > > > Emulation of VMPTRST can incorrectly inject a page fault > > when passed an operand that points to an MMIO address. > > The page fault will use uninitialized kernel stack memory > > as the CR2 and error code. >

Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-12 Thread Fuqian Huang
Vitaly Kuznetsov 於 2019年9月12日週四 下午6:53寫道： > > Fuqian Huang writes: > > > Vitaly Kuznetsov 於 2019年9月12日週四 下午4:51寫道： > >> > >> Fuqian Huang writes: > >> > >> > Emulation of VMPTRST can incorrectly inject a page fault > >> > when passed an operand that points to an MMIO address. > >> > The page fa

Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-12 Thread Vitaly Kuznetsov
Fuqian Huang writes: > Vitaly Kuznetsov 於 2019年9月12日週四 下午4:51寫道： >> >> Fuqian Huang writes: >> >> > Emulation of VMPTRST can incorrectly inject a page fault >> > when passed an operand that points to an MMIO address. >> > The page fault will use uninitialized kernel stack memory >> > as the CR2

Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-12 Thread Fuqian Huang
Vitaly Kuznetsov 於 2019年9月12日週四 下午4:51寫道： > > Fuqian Huang writes: > > > Emulation of VMPTRST can incorrectly inject a page fault > > when passed an operand that points to an MMIO address. > > The page fault will use uninitialized kernel stack memory > > as the CR2 and error code. > > > > The rig

Re: [PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-12 Thread Vitaly Kuznetsov
Fuqian Huang writes: > Emulation of VMPTRST can incorrectly inject a page fault > when passed an operand that points to an MMIO address. > The page fault will use uninitialized kernel stack memory > as the CR2 and error code. > > The right behavior would be to abort the VM with a KVM_EXIT_INTERNA

[PATCH] KVM: x86: work around leak of uninitialized stack contents

2019-09-11 Thread Fuqian Huang
Emulation of VMPTRST can incorrectly inject a page fault when passed an operand that points to an MMIO address. The page fault will use uninitialized kernel stack memory as the CR2 and error code. The right behavior would be to abort the VM with a KVM_EXIT_INTERNAL_ERROR exit to userspace; however

[PATCH] KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)

2019-02-07 Thread Paolo Bonzini
Bugzilla: 1671930 Emulation of certain instructions (VMXON, VMCLEAR, VMPTRLD, VMWRITE with memory operand, INVEPT, INVVPID) can incorrectly inject a page fault when passed an operand that points to an MMIO address. The page fault will use uninitialized kernel stack memory as the CR2 and error cod