swh:1:snp:32555a3fd8878f019c2ebd6c964bc1edcaeff337
Revision 282da870f4b5868efadcd4dc2a5a738d6fdf65d4 authored by Jan Kiszka on 08 October 2014, 16:05:39 UTC, committed by Paolo Bonzini on 02 November 2014, 06:55:46 UTC
In order to access the shadow VMCS, we need to load it. At this point, vmx->loaded_vmcs->vmcs and the actually loaded one start to differ. If we now get preempted by Linux, vmx_vcpu_put and, on return, the vmx_vcpu_load will work against the wrong vmcs. That can cause copy_shadow_to_vmcs12 to corrupt the vmcs12 state. Fix the issue by disabling preemption during the copy operation. copy_vmcs12_to_shadow is safe from this issue as it is executed by vmx_vcpu_run when preemption is already disabled before vmentry. This bug is exposed by running Jailhouse within KVM on CPUs with shadow VMCS support. Jailhouse never expects an interrupt pending vmexit, but the bug can cause it if, after copy_shadow_to_vmcs12 is preempted, the active VMCS happens to have the virtual interrupt pending flag set in the CPU-based execution controls. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent 7e46ddd
Tip revision: ffb4d94b4314655cea60ab7962756e6bab72fc7e authored by Linus Torvalds on 30 September 2022, 23:25:52 UTC
Merge tag 'drm-fixes-2022-10-01' of git://anongit.freedesktop.org/drm/drm
Merge tag 'drm-fixes-2022-10-01' of git://anongit.freedesktop.org/drm/drm
Tip revision: ffb4d94
File | Mode | Size |
---|---|---|
Documentation | ||
arch | ||
block | ||
crypto | ||
drivers | ||
firmware | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
samples | ||
scripts | ||
security | ||
sound | ||
tools | ||
usr | ||
virt | ||
.gitignore | -rw-r--r-- | 1.1 KB |
.mailmap | -rw-r--r-- | 4.7 KB |
COPYING | -rw-r--r-- | 18.3 KB |
CREDITS | -rw-r--r-- | 93.8 KB |
Kbuild | -rw-r--r-- | 2.5 KB |
Kconfig | -rw-r--r-- | 252 bytes |
MAINTAINERS | -rw-r--r-- | 284.4 KB |
Makefile | -rw-r--r-- | 53.1 KB |
README | -rw-r--r-- | 18.3 KB |
REPORTING-BUGS | -rw-r--r-- | 7.3 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...