]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
KVM: x86: Fix misplaced backport of "work around leak of uninitialized stack contents"
authorGuillaume Bertholon <guillaume.bertholon@ens.fr>
Tue, 1 Feb 2022 17:17:51 +0000 (18:17 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 3 Feb 2022 08:27:54 +0000 (09:27 +0100)
The upstream commit 541ab2aeb282 ("KVM: x86: work around leak of
uninitialized stack contents") resets `exception` in the function
`kvm_write_guest_virt_system`.
However, its backported version in stable (commit ba7f1c934f2e
("KVM: x86: work around leak of uninitialized stack contents")) applied
the change in `emulator_write_std` instead.

This patch moves the memset instruction back to
`kvm_write_guest_virt_system`.

Fixes: ba7f1c934f2e ("KVM: x86: work around leak of uninitialized stack contents")
Signed-off-by: Guillaume Bertholon <guillaume.bertholon@ens.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/x86/kvm/x86.c

index 8dce61ca934b24d5be310d9bb2bc7c4065a6afeb..910100257df93c18b8195a7b681c17a70a9dd579 100644 (file)
@@ -4417,13 +4417,6 @@ static int emulator_write_std(struct x86_emulate_ctxt *ctxt, gva_t addr, void *v
        if (!system && kvm_x86_ops->get_cpl(vcpu) == 3)
                access |= PFERR_USER_MASK;
 
-       /*
-        * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
-        * is returned, but our callers are not ready for that and they blindly
-        * call kvm_inject_page_fault.  Ensure that they at least do not leak
-        * uninitialized kernel stack memory into cr2 and error code.
-        */
-       memset(exception, 0, sizeof(*exception));
        return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,
                                           access, exception);
 }
@@ -4431,6 +4424,13 @@ static int emulator_write_std(struct x86_emulate_ctxt *ctxt, gva_t addr, void *v
 int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val,
                                unsigned int bytes, struct x86_exception *exception)
 {
+       /*
+        * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
+        * is returned, but our callers are not ready for that and they blindly
+        * call kvm_inject_page_fault.  Ensure that they at least do not leak
+        * uninitialized kernel stack memory into cr2 and error code.
+        */
+       memset(exception, 0, sizeof(*exception));
        return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,
                                           PFERR_WRITE_MASK, exception);
 }