59 lines
2 KiB
Diff
59 lines
2 KiB
Diff
From 80377e1fac45a547a43511ee5c8d783a7ec37be5 Mon Sep 17 00:00:00 2001
|
|
From: Maxim Levitsky <mlevitsk@redhat.com>
|
|
Date: Tue, 25 Oct 2022 15:47:32 +0300
|
|
Subject: [PATCH] KVM: x86: smm: number of GPRs in the SMRAM image depends on
|
|
the image format
|
|
|
|
On 64 bit host, if the guest doesn't have X86_FEATURE_LM, KVM will
|
|
access 16 gprs to 32-bit smram image, causing out-ouf-bound ram
|
|
access.
|
|
|
|
On 32 bit host, the rsm_load_state_64/enter_smm_save_state_64
|
|
is compiled out, thus access overflow can't happen.
|
|
|
|
Fixes: b443183a25ab61 ("KVM: x86: Reduce the number of emulator GPRs to '8' for 32-bit KVM")
|
|
|
|
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
|
|
Reviewed-by: Sean Christopherson <seanjc@google.com>
|
|
---
|
|
arch/x86/kvm/emulate.c | 1 +
|
|
arch/x86/kvm/smm.c | 4 ++--
|
|
2 files changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
|
|
index 5d7d4c1be843..02a01c65471b 100644
|
|
--- a/arch/x86/kvm/emulate.c
|
|
+++ b/arch/x86/kvm/emulate.c
|
|
@@ -2305,6 +2305,7 @@ static int em_lseg(struct x86_emulate_ctxt *ctxt)
|
|
return rc;
|
|
}
|
|
|
|
+
|
|
static int em_rsm(struct x86_emulate_ctxt *ctxt)
|
|
{
|
|
if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_MASK) == 0)
|
|
diff --git a/arch/x86/kvm/smm.c b/arch/x86/kvm/smm.c
|
|
index 41ca128478fc..b290ad14070f 100644
|
|
--- a/arch/x86/kvm/smm.c
|
|
+++ b/arch/x86/kvm/smm.c
|
|
@@ -382,7 +382,7 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt,
|
|
ctxt->eflags = GET_SMSTATE(u32, smstate, 0x7ff4) | X86_EFLAGS_FIXED;
|
|
ctxt->_eip = GET_SMSTATE(u32, smstate, 0x7ff0);
|
|
|
|
- for (i = 0; i < NR_EMULATOR_GPRS; i++)
|
|
+ for (i = 0; i < 8; i++)
|
|
*reg_write(ctxt, i) = GET_SMSTATE(u32, smstate, 0x7fd0 + i * 4);
|
|
|
|
val = GET_SMSTATE(u32, smstate, 0x7fcc);
|
|
@@ -438,7 +438,7 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt,
|
|
u64 val, cr0, cr3, cr4;
|
|
int i, r;
|
|
|
|
- for (i = 0; i < NR_EMULATOR_GPRS; i++)
|
|
+ for (i = 0; i < 16; i++)
|
|
*reg_write(ctxt, i) = GET_SMSTATE(u64, smstate, 0x7ff8 - i * 8);
|
|
|
|
ctxt->_eip = GET_SMSTATE(u64, smstate, 0x7f78);
|
|
--
|
|
2.38.1
|
|
|