Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5a63723 authored by Guillaume Bertholon's avatar Guillaume Bertholon Committed by corsicanu
Browse files

KVM: x86: Fix misplaced backport of "work around leak of uninitialized stack contents" 



The upstream commit 541ab2aeb282 ("KVM: x86: work around leak of
uninitialized stack contents") resets `exception` in the function
`kvm_write_guest_virt_system`.
However, its backported version in stable (commit ba7f1c934f2e
("KVM: x86: work around leak of uninitialized stack contents")) applied
the change in `emulator_write_std` instead.

This patch moves the memset instruction back to
`kvm_write_guest_virt_system`.

Fixes: ba7f1c934f2e ("KVM: x86: work around leak of uninitialized stack contents")
Signed-off-by: default avatarGuillaume Bertholon <guillaume.bertholon@ens.fr>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e0aaddc2

arch/x86/kvm/x86.c

+7 −7
Original line number Diff line number Diff line
@@ -4417,13 +4417,6 @@ static int emulator_write_std(struct x86_emulate_ctxt *ctxt, gva_t addr, void *v 
	if (!system && kvm_x86_ops->get_cpl(vcpu) == 3)

		access |= PFERR_USER_MASK;



	/*

	 * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED

	 * is returned, but our callers are not ready for that and they blindly

	 * call kvm_inject_page_fault.  Ensure that they at least do not leak

	 * uninitialized kernel stack memory into cr2 and error code.

	 */

	memset(exception, 0, sizeof(*exception));

	return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,

					   access, exception);

}
@@ -4431,6 +4424,13 @@ static int emulator_write_std(struct x86_emulate_ctxt *ctxt, gva_t addr, void *v 
int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val,

				unsigned int bytes, struct x86_exception *exception)

{

	/*

	 * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED

	 * is returned, but our callers are not ready for that and they blindly

	 * call kvm_inject_page_fault.  Ensure that they at least do not leak

	 * uninitialized kernel stack memory into cr2 and error code.

	 */

	memset(exception, 0, sizeof(*exception));

	return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,

					   PFERR_WRITE_MASK, exception);

}