From: Vitaly Kuznetsov <vkuznets@redhat.com>
To: kvm@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <sean.j.christopherson@intel.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>,
Peter Shier <pshier@google.com>,
linux-kernel@vger.kernel.org
Subject: [PATCH v2] KVM: nVMX: fix the layout of struct kvm_vmx_nested_state_hdr
Date: Mon, 13 Jul 2020 18:22:06 +0200 [thread overview]
Message-ID: <20200713162206.1930767-1-vkuznets@redhat.com> (raw)
Before commit 850448f35aaf ("KVM: nVMX: Fix VMX preemption timer
migration") struct kvm_vmx_nested_state_hdr looked like:
struct kvm_vmx_nested_state_hdr {
__u64 vmxon_pa;
__u64 vmcs12_pa;
struct {
__u16 flags;
} smm;
}
The ABI got broken by the above mentioned commit and an attempt
to fix that was made in commit 83d31e5271ac ("KVM: nVMX: fixes for
preemption timer migration") which made the structure look like:
struct kvm_vmx_nested_state_hdr {
__u64 vmxon_pa;
__u64 vmcs12_pa;
struct {
__u16 flags;
} smm;
__u32 flags;
__u64 preemption_timer_deadline;
};
The problem with this layout is that before both changes compilers were
allocating 24 bytes for this and although smm.flags is padded to 8 bytes,
it is initialized as a 2 byte value. Chances are that legacy userspaces
using old layout will be passing uninitialized bytes which will slip into
what is now known as 'flags'.
Suggested-by: Sean Christopherson <sean.j.christopherson@intel.com>
Fixes: 850448f35aaf ("KVM: nVMX: Fix VMX preemption timer migration")
Fixes: 83d31e5271ac ("KVM: nVMX: fixes for preemption timer migration")
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
- The patch breaks ABI so it needs to go into 5.8.
- This is a successor of "[PATCH] KVM: nVMX: properly pad struct
kvm_vmx_nested_state_hdr"
---
Documentation/virt/kvm/api.rst | 5 +++--
arch/x86/include/uapi/asm/kvm.h | 5 +++--
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
index 320788f81a05..e75992ad856a 100644
--- a/Documentation/virt/kvm/api.rst
+++ b/Documentation/virt/kvm/api.rst
@@ -4345,8 +4345,9 @@ Errors:
struct {
__u16 flags;
} smm;
-
- __u32 flags;
+ __u16 pad16;
+ __u32 pad32;
+ __u64 flags;
__u64 preemption_timer_deadline;
};
diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
index 0780f97c1850..4ecc6bd49818 100644
--- a/arch/x86/include/uapi/asm/kvm.h
+++ b/arch/x86/include/uapi/asm/kvm.h
@@ -414,8 +414,9 @@ struct kvm_vmx_nested_state_hdr {
struct {
__u16 flags;
} smm;
-
- __u32 flags;
+ __u16 pad16;
+ __u32 pad32;
+ __u64 flags;
__u64 preemption_timer_deadline;
};
--
2.25.4
next reply other threads:[~2020-07-13 16:22 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-13 16:22 Vitaly Kuznetsov [this message]
2020-07-13 18:23 ` [PATCH v2] KVM: nVMX: fix the layout of struct kvm_vmx_nested_state_hdr Jim Mattson
2020-08-27 18:25 ` Jim Mattson
2020-08-27 20:40 ` Sean Christopherson
2020-08-30 9:52 ` Paolo Bonzini
2020-08-30 9:52 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200713162206.1930767-1-vkuznets@redhat.com \
--to=vkuznets@redhat.com \
--cc=jmattson@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=pshier@google.com \
--cc=sean.j.christopherson@intel.com \
--cc=wanpengli@tencent.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox