Commit 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run") applied a patch from upstream, but it appears that it wasn't backported correctly to 4.14. The extra out_fpu label and kvm_put_guest_fpu() added in kvm_arch_vcpu_ioctl_run() result in calling kvm_put_guest_fpu() twice in a row, corrupting guest state.
Fixes: 4124a4cff344 ("x86,kvm: move qemu/guest FPU switching out to vcpu_run") Signed-off-by: Daniel Verkamp dverkamp@chromium.org ---
I'm unsure if this is the right way to send this fix - there is no corresponding mainline commit to reference, since the code there is already correct, and the problem was introduced in the cherry-picked stable backport. Please let me know if there's a different process for fixes to stable-only issues.
arch/x86/kvm/x86.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 130be2efafbe..3e767430d3b2 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -7430,7 +7430,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) vcpu->arch.complete_userspace_io = NULL; r = cui(vcpu); if (r <= 0) - goto out_fpu; + goto out; } else WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed);
@@ -7439,8 +7439,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) else r = vcpu_run(vcpu);
-out_fpu: - kvm_put_guest_fpu(vcpu); out: kvm_put_guest_fpu(vcpu); post_kvm_run_save(vcpu);