[PATCH] x86,kvm: remove duplicate kvm_put_guest_fpu()

[PATCH] x86,kvm: remove duplicate kvm_put_guest_fpu()

[Daniel Verkamp]

Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out
to vcpu_run") applied a patch from upstream, but it appears that it
wasn't backported correctly to 4.14.  The extra out_fpu label and
kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling
kvm_put_guest_fpu() twice in a row, corrupting guest state.

Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
---

I'm unsure if this is the right way to send this fix - there is no
corresponding mainline commit to reference, since the code there is
already correct, and the problem was introduced in the cherry-picked
stable backport.  Please let me know if there's a different process for
fixes to stable-only issues.

 arch/x86/kvm/x86.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 130be2efafbe..3e767430d3b2 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7430,7 +7430,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 		vcpu->arch.complete_userspace_io = NULL;
 		r = cui(vcpu);
 		if (r <= 0)
-			goto out_fpu;
+			goto out;
 	} else
 		WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed);
 
@@ -7439,8 +7439,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 	else
 		r = vcpu_run(vcpu);
 
-out_fpu:
-	kvm_put_guest_fpu(vcpu);
 out:
 	kvm_put_guest_fpu(vcpu);
 	post_kvm_run_save(vcpu);
-- 
2.20.1.495.gaa96b0ce6b-goog

[PATCH v2 for-4.14-stable] x86,kvm: remove extra kvm_{get,put}_guest_fpu

[Daniel Verkamp]

Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out
to vcpu_run") applied a patch from upstream, but it appears that it
wasn't backported correctly to 4.14.  The extra out_fpu label and
kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling
kvm_put_guest_fpu() twice in a row, corrupting guest state.
Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of
the function.

Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
---

v2: removed additional redundant kvm_load_guest_fpu()

I'm unsure if this is the right way to send this fix - there is no
corresponding mainline commit to reference, since the code there is
already correct, and the problem was introduced in the cherry-picked
stable backport.  Please let me know if there's a different process for
fixes to stable-only issues.

---

 arch/x86/kvm/x86.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 130be2efafbe..af7ab2c71786 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7423,14 +7423,12 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 		}
 	}
 
-	kvm_load_guest_fpu(vcpu);
-
 	if (unlikely(vcpu->arch.complete_userspace_io)) {
 		int (*cui)(struct kvm_vcpu *) = vcpu->arch.complete_userspace_io;
 		vcpu->arch.complete_userspace_io = NULL;
 		r = cui(vcpu);
 		if (r <= 0)
-			goto out_fpu;
+			goto out;
 	} else
 		WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed);
 
@@ -7439,8 +7437,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
 	else
 		r = vcpu_run(vcpu);
 
-out_fpu:
-	kvm_put_guest_fpu(vcpu);
 out:
 	kvm_put_guest_fpu(vcpu);
 	post_kvm_run_save(vcpu);
-- 
2.20.1.495.gaa96b0ce6b-goog

Re: [PATCH v2 for-4.14-stable] x86,kvm: remove extra kvm_{get,put}_guest_fpu

[Daniel Verkamp]

On Wed, Jan 30, 2019 at 2:29 PM Daniel Verkamp <dverkamp@chromium.org> wrote:
>
> Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out
> to vcpu_run") applied a patch from upstream, but it appears that it
> wasn't backported correctly to 4.14.  The extra out_fpu label and
> kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling
> kvm_put_guest_fpu() twice in a row, corrupting guest state.
> Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of
> the function.
>
> Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
> Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
> ---
>
> v2: removed additional redundant kvm_load_guest_fpu()
>
> I'm unsure if this is the right way to send this fix - there is no
> corresponding mainline commit to reference, since the code there is
> already correct, and the problem was introduced in the cherry-picked
> stable backport.  Please let me know if there's a different process for
> fixes to stable-only issues.

Please ignore this - I had checked last week and it seemed no-one had
reported this, but now it looks like an identical fix was already
posted: https://www.spinics.net/lists/stable/msg282163.html

Sorry for the noise!

Thanks,
-- Daniel

Re: [PATCH v2 for-4.14-stable] x86,kvm: remove extra kvm_{get,put}_guest_fpu

[Greg KH]

On Wed, Jan 30, 2019 at 02:29:26PM -0800, Daniel Verkamp wrote:
> Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out
> to vcpu_run") applied a patch from upstream, but it appears that it
> wasn't backported correctly to 4.14.  The extra out_fpu label and
> kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling
> kvm_put_guest_fpu() twice in a row, corrupting guest state.
> Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of
> the function.
> 
> Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
> Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
> ---
> 
> v2: removed additional redundant kvm_load_guest_fpu()
> 
> I'm unsure if this is the right way to send this fix - there is no
> corresponding mainline commit to reference, since the code there is
> already correct, and the problem was introduced in the cherry-picked
> stable backport.  Please let me know if there's a different process for
> fixes to stable-only issues.

This should now be fixed with 9485d5d2318b ("KVM: x86: Fix a 4.14
backport regression related to userspace/guest FPU") in the 4.14.97
release that just happened, right?

thanks,

greg k-h

Re: [PATCH v2 for-4.14-stable] x86,kvm: remove extra kvm_{get,put}_guest_fpu

[Daniel Verkamp]

Yes, please disregard this patch - I had this on my to-do list to
investigate and missed the stable update that fixed it already.

Thanks,
-- Daniel

On Wed, Jan 30, 2019 at 11:18 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Wed, Jan 30, 2019 at 02:29:26PM -0800, Daniel Verkamp wrote:
> > Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out
> > to vcpu_run") applied a patch from upstream, but it appears that it
> > wasn't backported correctly to 4.14.  The extra out_fpu label and
> > kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling
> > kvm_put_guest_fpu() twice in a row, corrupting guest state.
> > Additionally, a duplicate kvm_load_guest_fpu() is added in the middle of
> > the function.
> >
> > Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run")
> > Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
> > ---
> >
> > v2: removed additional redundant kvm_load_guest_fpu()
> >
> > I'm unsure if this is the right way to send this fix - there is no
> > corresponding mainline commit to reference, since the code there is
> > already correct, and the problem was introduced in the cherry-picked
> > stable backport.  Please let me know if there's a different process for
> > fixes to stable-only issues.
>
> This should now be fixed with 9485d5d2318b ("KVM: x86: Fix a 4.14
> backport regression related to userspace/guest FPU") in the 4.14.97
> release that just happened, right?
>
> thanks,
>
> greg k-h