[PATCH] KVM: nVMX: Nullify cached vmcs12 pointers if entering VMX operation fails

[PATCH] KVM: nVMX: Nullify cached vmcs12 pointers if entering VMX operation fails

[Sean Christopherson]

From: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>

Nullify the cached vmcs12 pointers after freeing them if "entering" VMX
ultimately fails (because of an allocation failure), so that if a stale
pointer is consumed, KVM hits a NULL pointer dereference instead of a
use-after-free.  I.e. crash the host instead of providing a potential
guest escape vector if KVM is buggy.

Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
[sean: rework changelog, drop stable@]
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/vmx/nested.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 9b0bfa2f854c..3509a84acde2 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5463,9 +5463,11 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu)
 
 out_shadow_vmcs:
 	kfree(vmx->nested.cached_shadow_vmcs12);
+	vmx->nested.cached_shadow_vmcs12 = NULL;
 
 out_cached_shadow_vmcs12:
 	kfree(vmx->nested.cached_vmcs12);
+	vmx->nested.cached_vmcs12 = NULL;
 
 out_cached_vmcs12:
 	free_loaded_vmcs(&vmx->nested.vmcs02);

base-commit: 164405e8e9a0378c7e1aff2254625a6553a291f1
-- 
2.56.0.257.gf7497c7d27-goog