KVM: x86: Handle errors when RIP is set during far jumps
authorNadav Amit <namit@cs.technion.ac.il>
Thu, 18 Sep 2014 19:39:39 +0000 (22:39 +0300)
committerPaolo Bonzini <pbonzini@redhat.com>
Fri, 24 Oct 2014 11:21:16 +0000 (13:21 +0200)
commitd1442d85cc30ea75f7d399474ca738e0bc96f715
treeabee3c5d2d0c427e87d76299536e4af37a9a17dc
parent234f3ce485d54017f15cf5e0699cff4100121601
KVM: x86: Handle errors when RIP is set during far jumps

Far jmp/call/ret may fault while loading a new RIP.  Currently KVM does not
handle this case, and may result in failed vm-entry once the assignment is
done.  The tricky part of doing so is that loading the new CS affects the
VMCS/VMCB state, so if we fail during loading the new RIP, we are left in
unconsistent state.  Therefore, this patch saves on 64-bit the old CS
descriptor and restores it if loading RIP failed.

This fixes CVE-2014-3647.

Cc: stable@vger.kernel.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
arch/x86/kvm/emulate.c