diff options
| author | Nadav Amit <namit@cs.technion.ac.il> | 2014-09-18 22:39:39 +0300 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2014-10-24 13:21:16 +0200 |
| commit | d1442d85cc30ea75f7d399474ca738e0bc96f715 (patch) | |
| tree | abee3c5d2d0c427e87d76299536e4af37a9a17dc /arch/x86/kvm/vmx.c | |
| parent | 234f3ce485d54017f15cf5e0699cff4100121601 (diff) | |
| download | lwn-d1442d85cc30ea75f7d399474ca738e0bc96f715.tar.gz lwn-d1442d85cc30ea75f7d399474ca738e0bc96f715.zip | |
KVM: x86: Handle errors when RIP is set during far jumps
Far jmp/call/ret may fault while loading a new RIP. Currently KVM does not
handle this case, and may result in failed vm-entry once the assignment is
done. The tricky part of doing so is that loading the new CS affects the
VMCS/VMCB state, so if we fail during loading the new RIP, we are left in
unconsistent state. Therefore, this patch saves on 64-bit the old CS
descriptor and restores it if loading RIP failed.
This fixes CVE-2014-3647.
Cc: stable@vger.kernel.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'arch/x86/kvm/vmx.c')
0 files changed, 0 insertions, 0 deletions