KVM: Fix fs/gs reload oops with invalid ldt

kvm reloads the host's fs and gs blindly, however the underlying segment
descriptors may be invalid due to the user modifying the ldt after loading
them.

Fix by using the safe accessors (loadsegment() and load_gs_index()) instead
of home grown unsafe versions.

This is CVE-2010-3698.

KVM-Stable-Tag.
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

1 files changed, 10 insertions, 5 deletions

diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 81ed28cb36e6..8a3f9f64f86f 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3163,8 +3163,8 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
         sync_lapic_to_cr8(vcpu);
 
         save_host_msrs(vcpu);
-        fs_selector = kvm_read_fs();
-        gs_selector = kvm_read_gs();
+        savesegment(fs, fs_selector);
+        savesegment(gs, gs_selector);
         ldt_selector = kvm_read_ldt();
         svm->vmcb->save.cr2 = vcpu->arch.cr2;
         /* required for live migration with NPT */
@@ -3251,10 +3251,15 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
         vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
         vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
 
-        kvm_load_fs(fs_selector);
-        kvm_load_gs(gs_selector);
-        kvm_load_ldt(ldt_selector);
         load_host_msrs(vcpu);
+        loadsegment(fs, fs_selector);
+#ifdef CONFIG_X86_64
+        load_gs_index(gs_selector);
+        wrmsrl(MSR_KERNEL_GS_BASE, current->thread.gs);
+#else
+        loadsegment(gs, gs_selector);
+#endif
+        kvm_load_ldt(ldt_selector);
 
         reload_tss(vcpu);