From a013e1b9e95e9f30db180e97ef9ee41e800c6d39 Mon Sep 17 00:00:00 2001 From: Sergey Dyasli Date: Fri, 3 Mar 2017 11:58:47 +0100 Subject: [PATCH] x86/vvmx: check vmcs address in vmread/vmwrite If nested vmcs's address is invalid, virtual_vmcs_enter() will fail during vmread/vmwrite: (XEN) Xen BUG at .../git/upstream/xen/xen/include/asm/hvm/vmx/vmx.h:333 (XEN) ----[ Xen-4.9-unstable x86_64 debug=y Tainted: H ]---- (XEN) Xen call trace: (XEN) [] vmcs.c#arch/x86/hvm/vmx/vmcs.o.unlikely+0x28/0x19a (XEN) [] virtual_vmcs_vmwrite_safe+0x16/0x52 (XEN) [] nvmx_handle_vmwrite+0x70/0xfe (XEN) [] vmx_vmexit_handler+0x1379/0x1c49 (XEN) [] vmx_asm_vmexit_handler+0x3c/0x120 Fix this by emulating VMfailInvalid if the address is invalid. Signed-off-by: Sergey Dyasli Reviewed-by: Andrew Cooper Acked-by: Kevin Tian --- xen/arch/x86/hvm/vmx/vvmx.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c index 2958593fff..ec4ff35d63 100644 --- a/xen/arch/x86/hvm/vmx/vvmx.c +++ b/xen/arch/x86/hvm/vmx/vvmx.c @@ -1759,6 +1759,12 @@ int nvmx_handle_vmread(struct cpu_user_regs *regs) if ( rc != X86EMUL_OKAY ) return rc; + if ( vcpu_nestedhvm(v).nv_vvmcxaddr == INVALID_PADDR ) + { + vmfail_invalid(regs); + return X86EMUL_OKAY; + } + rc = get_vvmcs_safe(v, reg_read(regs, decode.reg2), &value); if ( rc != VMX_INSN_SUCCEED ) { @@ -1796,6 +1802,12 @@ int nvmx_handle_vmwrite(struct cpu_user_regs *regs) != X86EMUL_OKAY ) return X86EMUL_EXCEPTION; + if ( vcpu_nestedhvm(v).nv_vvmcxaddr == INVALID_PADDR ) + { + vmfail_invalid(regs); + return X86EMUL_OKAY; + } + vmcs_encoding = reg_read(regs, decode.reg2); err = set_vvmcs_safe(v, vmcs_encoding, operand); if ( err != VMX_INSN_SUCCEED ) -- 2.39.5