[PATCH] kvm: fix MSR_COUNT for kvm_arch_save_regs()

[PATCH] kvm: fix MSR_COUNT for kvm_arch_save_regs()

[Eduardo Habkost]

A new register was added to the load/save list on commit
d283d5a65a2bdcc570065267be21848bd6fe3d78, but MSR_COUNT was not updated, leading
to potential stack corruption on kvm_arch_save_regs().

The following registers are saved by kvm_arch_save_regs():

 1) MSR_IA32_SYSENTER_CS
 2) MSR_IA32_SYSENTER_ESP
 3) MSR_IA32_SYSENTER_EIP
 4) MSR_STAR
 5) MSR_IA32_TSC
 6) MSR_VM_HSAVE_PA
 7) MSR_CSTAR (x86_64 only)
 8) MSR_KERNELGSBASE (x86_64 only)
 9) MSR_FMASK (x86_64 only)
10) MSR_LSTAR (x86_64 only)

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 qemu-kvm-x86.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/qemu-kvm-x86.c b/qemu-kvm-x86.c
index acb1b91..81d2c53 100644
--- a/qemu-kvm-x86.c
+++ b/qemu-kvm-x86.c
@@ -847,9 +847,9 @@ static int get_msr_entry(struct kvm_msr_entry *entry, CPUState *env)
 }
 
 #ifdef TARGET_X86_64
-#define MSR_COUNT 9
+#define MSR_COUNT 10
 #else
-#define MSR_COUNT 5
+#define MSR_COUNT 6
 #endif
 
 static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
@@ -991,6 +991,7 @@ void kvm_arch_load_regs(CPUState *env)
 
     /* msrs */
     n = 0;
+    /* Remember to increase MSR_COUNT if you add new registers below */
     set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_CS,  env->sysenter_cs);
     set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_ESP, env->sysenter_esp);
     set_msr_entry(&msrs[n++], MSR_IA32_SYSENTER_EIP, env->sysenter_eip);
@@ -1168,6 +1169,7 @@ void kvm_arch_save_regs(CPUState *env)
 
     /* msrs */
     n = 0;
+    /* Remember to increase MSR_COUNT if you add new registers below */
     msrs[n++].index = MSR_IA32_SYSENTER_CS;
     msrs[n++].index = MSR_IA32_SYSENTER_ESP;
     msrs[n++].index = MSR_IA32_SYSENTER_EIP;
-- 
1.6.3.rc4.29.g8146

-- 
Eduardo

Re: [PATCH] kvm: fix MSR_COUNT for kvm_arch_save_regs()

[Marcelo Tosatti]

On Wed, Oct 14, 2009 at 03:02:27PM -0300, Eduardo Habkost wrote:
> 
> A new register was added to the load/save list on commit
> d283d5a65a2bdcc570065267be21848bd6fe3d78, but MSR_COUNT was not updated, leading
> to potential stack corruption on kvm_arch_save_regs().
> 
> The following registers are saved by kvm_arch_save_regs():
> 
>  1) MSR_IA32_SYSENTER_CS
>  2) MSR_IA32_SYSENTER_ESP
>  3) MSR_IA32_SYSENTER_EIP
>  4) MSR_STAR
>  5) MSR_IA32_TSC
>  6) MSR_VM_HSAVE_PA
>  7) MSR_CSTAR (x86_64 only)
>  8) MSR_KERNELGSBASE (x86_64 only)
>  9) MSR_FMASK (x86_64 only)
> 10) MSR_LSTAR (x86_64 only)
> 
> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

Applied, thanks.

Re: [PATCH] kvm: fix MSR_COUNT for kvm_arch_save_regs()

[Mark McLoughlin]

On Wed, 2009-10-14 at 15:02 -0300, Eduardo Habkost wrote:
> A new register was added to the load/save list on commit
> d283d5a65a2bdcc570065267be21848bd6fe3d78, but MSR_COUNT was not updated, leading
> to potential stack corruption on kvm_arch_save_regs().
> 
> The following registers are saved by kvm_arch_save_regs():
> 
>  1) MSR_IA32_SYSENTER_CS
>  2) MSR_IA32_SYSENTER_ESP
>  3) MSR_IA32_SYSENTER_EIP
>  4) MSR_STAR
>  5) MSR_IA32_TSC
>  6) MSR_VM_HSAVE_PA
>  7) MSR_CSTAR (x86_64 only)
>  8) MSR_KERNELGSBASE (x86_64 only)
>  9) MSR_FMASK (x86_64 only)
> 10) MSR_LSTAR (x86_64 only)
> 
> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

Forgot:

  Reported-by: Ulrich Obergfell <uobergfe@redhat.com>

Looks like the fix is needed on both stable-0.10 and stable-0.11 as well
as master

Cheers,
Mark.