1 files changed, 12 insertions, 0 deletions

diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index a15a8880066..f84f5c57de3 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -395,6 +395,14 @@ static __kprobes void default_do_nmi(struct pt_regs *regs)
  * thus there is no race between the first check of state for NOT_RUNNING
  * and setting it to NMI_EXECUTING. The HW will prevent nested NMIs
  * at this point.
+ *
+ * In case the NMI takes a page fault, we need to save off the CR2
+ * because the NMI could have preempted another page fault and corrupt
+ * the CR2 that is about to be read. As nested NMIs must be restarted
+ * and they can not take breakpoints or page faults, the update of the
+ * CR2 must be done before converting the nmi state back to NOT_RUNNING.
+ * Otherwise, there would be a race of another nested NMI coming in
+ * after setting state to NOT_RUNNING but before updating the nmi_cr2.
  */
 enum nmi_states {
         NMI_NOT_RUNNING = 0,
@@ -402,6 +410,7 @@ enum nmi_states {
         NMI_LATCHED,
 };
 static DEFINE_PER_CPU(enum nmi_states, nmi_state);
+static DEFINE_PER_CPU(unsigned long, nmi_cr2);
 
 #define nmi_nesting_preprocess(regs)                                    \
         do {                                                            \
@@ -410,11 +419,14 @@ static DEFINE_PER_CPU(enum nmi_states, nmi_state);
                         return;                                         \
                 }                                                       \
                 this_cpu_write(nmi_state, NMI_EXECUTING);               \
+                this_cpu_write(nmi_cr2, read_cr2());                    \
         } while (0);                                                    \
         nmi_restart:
 
 #define nmi_nesting_postprocess()                                       \
         do {                                                            \
+                if (unlikely(this_cpu_read(nmi_cr2) != read_cr2()))     \
+                        write_cr2(this_cpu_read(nmi_cr2));              \
                 if (this_cpu_dec_return(nmi_state))                     \
                         goto nmi_restart;                               \
         } while (0)