KVM: nSVM: Check the value written to MSR_VM_HSAVE_PA
APM states that #GP is raised upon write to MSR_VM_HSAVE_PA when the supplied address is not page-aligned or is outside of "maximum supported physical address for this implementation". page_address_valid() check seems suitable. Also, forcefully page-align the address when it's written from VMM. Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Message-Id: <20210628104425.391276-2-vkuznets@redhat.com> Cc: stable@vger.kernel.org Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com> [Add comment about behavior for host-provided values. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
c7a1b2b678
commit
fce7e152ff
|
@ -2954,7 +2954,16 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
|
|||
svm_disable_lbrv(vcpu);
|
||||
break;
|
||||
case MSR_VM_HSAVE_PA:
|
||||
svm->nested.hsave_msr = data;
|
||||
/*
|
||||
* Old kernels did not validate the value written to
|
||||
* MSR_VM_HSAVE_PA. Allow KVM_SET_MSR to set an invalid
|
||||
* value to allow live migrating buggy or malicious guests
|
||||
* originating from those kernels.
|
||||
*/
|
||||
if (!msr->host_initiated && !page_address_valid(vcpu, data))
|
||||
return 1;
|
||||
|
||||
svm->nested.hsave_msr = data & PAGE_MASK;
|
||||
break;
|
||||
case MSR_VM_CR:
|
||||
return svm_set_vm_cr(vcpu, data);
|
||||
|
|
Loading…
Reference in New Issue