Cache g_pat from vmcb12 in svm->nested.gpat to avoid TOCTTOU issues, and add a validity check so that when nested paging is enabled for vmcb12, an invalid g_pat causes an immediate VMEXIT with exit code VMEXIT_INVALID, as specified in the APM, volume 2: "Nested Paging and VMRUN/VMEXIT." Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") Signed-off-by: Jim Mattson --- arch/x86/kvm/svm/nested.c | 4 +++- arch/x86/kvm/svm/svm.h | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index f72dbd10dcad..1d4ff6408b34 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1027,9 +1027,11 @@ int nested_svm_vmrun(struct kvm_vcpu *vcpu) nested_copy_vmcb_control_to_cache(svm, &vmcb12->control); nested_copy_vmcb_save_to_cache(svm, &vmcb12->save); + svm->nested.gpat = vmcb12->save.g_pat; if (!nested_vmcb_check_save(vcpu) || - !nested_vmcb_check_controls(vcpu)) { + !nested_vmcb_check_controls(vcpu) || + (nested_npt_enabled(svm) && !kvm_pat_valid(svm->nested.gpat))) { vmcb12->control.exit_code = SVM_EXIT_ERR; vmcb12->control.exit_info_1 = 0; vmcb12->control.exit_info_2 = 0; diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h index 986d90f2d4ca..42a4bf83b3aa 100644 --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -208,6 +208,9 @@ struct svm_nested_state { */ struct vmcb_save_area_cached save; + /* Cached guest PAT from vmcb12.save.g_pat */ + u64 gpat; + bool initialized; /* -- 2.53.0.rc2.204.g2597b5adb4-goog