1 files changed, 13 insertions, 4 deletions

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 02c8e095a239..941f932373d0 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3834,6 +3834,8 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
         case KVM_CAP_HYPERV_SYNIC2:
                 if (cap->args[0])
                         return -EINVAL;
+                /* fall through */
+
         case KVM_CAP_HYPERV_SYNIC:
                 if (!irqchip_in_kernel(vcpu->kvm))
                         return -EINVAL;
@@ -5114,6 +5116,13 @@ int kvm_read_guest_virt(struct kvm_vcpu *vcpu,
 {
         u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
 
+        /*
+         * FIXME: this should call handle_emulation_failure if X86EMUL_IO_NEEDED
+         * is returned, but our callers are not ready for that and they blindly
+         * call kvm_inject_page_fault.  Ensure that they at least do not leak
+         * uninitialized kernel stack memory into cr2 and error code.
+         */
+        memset(exception, 0, sizeof(*exception));
         return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access,
                                           exception);
 }
@@ -6480,8 +6489,7 @@ restart:
                 toggle_interruptibility(vcpu, ctxt->interruptibility);
                 vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
                 kvm_rip_write(vcpu, ctxt->eip);
-                if (r == EMULATE_DONE &&
-                    (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
+                if (r == EMULATE_DONE && ctxt->tf)
                         kvm_vcpu_do_singlestep(vcpu, &r);
                 if (!ctxt->have_exception ||
                     exception_type(ctxt->exception.vector) == EXCPT_TRAP)
@@ -7093,10 +7101,10 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu)
         case KVM_HC_CLOCK_PAIRING:
                 ret = kvm_pv_clock_pairing(vcpu, a0, a1);
                 break;
+#endif
         case KVM_HC_SEND_IPI:
                 ret = kvm_pv_send_ipi(vcpu->kvm, a0, a1, a2, a3, op_64_bit);
                 break;
-#endif
         default:
                 ret = -KVM_ENOSYS;
                 break;
@@ -7793,7 +7801,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
          * 1) We should set ->mode before checking ->requests.  Please see
          * the comment in kvm_vcpu_exiting_guest_mode().
          *
-         * 2) For APICv, we should set ->mode before checking PIR.ON.  This
+         * 2) For APICv, we should set ->mode before checking PID.ON. This
          * pairs with the memory barrier implicit in pi_test_and_set_on
          * (see vmx_deliver_posted_interrupt).
          *
@@ -7937,6 +7945,7 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
                 vcpu->arch.pv.pv_unhalted = false;
                 vcpu->arch.mp_state =
                         KVM_MP_STATE_RUNNABLE;
+                /* fall through */
         case KVM_MP_STATE_RUNNABLE:
                 vcpu->arch.apf.halted = false;
                 break;