On Wed, Jan 21, 2026 at 5:28 PM Yosry Ahmed <[email protected]> wrote: > > On Thu, Jan 15, 2026 at 03:21:41PM -0800, Jim Mattson wrote: > > To avoid TOCTTOU issues, all fields in the vmcb12 save area that are > > subject to validation must be copied to svm->nested.save prior to > > validation, since vmcb12 is writable by the guest. Add g_pat to this set in > > preparation for validting it. > > > > Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") > > g_pat is not currently used from VMCB12, so this patch isn't technically > fixing an issue, right? I suspect this only applies to patch 3.
The fact that VMCB12.g_pat isn't used *is* the issue. This patch is part of the fix. To make the fix easier to review, it's broken into several pieces. > Anyway, I think it's probably best to squash this into patch 3. Also > maybe CC stable? I will squash it in the next version. > > Signed-off-by: Jim Mattson <[email protected]> > > If you decide to keep this as an individual patch, feel free to add: > > Reviewed-by: Yosry Ahmed <[email protected]> > > > --- > > arch/x86/kvm/svm/nested.c | 2 ++ > > arch/x86/kvm/svm/svm.h | 1 + > > 2 files changed, 3 insertions(+) > > > > diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c > > index f295a41ec659..07a57a43fc3b 100644 > > --- a/arch/x86/kvm/svm/nested.c > > +++ b/arch/x86/kvm/svm/nested.c > > @@ -506,6 +506,8 @@ static void __nested_copy_vmcb_save_to_cache(struct > > vmcb_save_area_cached *to, > > > > to->dr6 = from->dr6; > > to->dr7 = from->dr7; > > + > > + to->g_pat = from->g_pat; > > } > > > > void nested_copy_vmcb_save_to_cache(struct vcpu_svm *svm, > > diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h > > index 7d28a739865f..39138378531e 100644 > > --- a/arch/x86/kvm/svm/svm.h > > +++ b/arch/x86/kvm/svm/svm.h > > @@ -145,6 +145,7 @@ struct vmcb_save_area_cached { > > u64 cr0; > > u64 dr7; > > u64 dr6; > > + u64 g_pat; > > }; > > > > struct vmcb_ctrl_area_cached { > > -- > > 2.52.0.457.g6b5491de43-goog > >
