[PATCH] KVM: nVMX: Clear nested.smm.guest_mode when freeing nested state

[Sean Christopherson]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

If an SMI arrives while L2 is active, vmx_enter_smm() forces a VM-Exit
to L1, and records in nested.smm.guest_mode that RSM has to re-enter L2
and in nested.smm.vmxon that the vCPU was post-VMXON.  free_nested()
clears the latter, but not the former.

Userspace can get KVM to free the nested state while the vCPU is in SMM,
with KVM_SET_NESTED_STATE, e.g. with no VMXON region to say that the
vCPU isn't in VMX operation, or by flipping the SMM flag back and forth
with KVM_SET_VCPU_EVENTS.  When the guest then executes RSM,
vmx_leave_smm() tries to re-enter L2 even though there is no vmcs12 any
more, and nested_vmx_check_restored_vmcs12() dereferences the NULL
nested.cached_vmcs12.

Clear nested.smm.guest_mode along with the state that it refers to.

Fixes: 8fcc4b5923af ("kvm: nVMX: Introduce KVM_CAP_NESTED_STATE")
Reported-by: Karthikeyan Bhargavan <karthik@xxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Cc: Chris Mason <mason@xxxxxxxxxx>
Co-developed-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@xxxxxxxx>
Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@xxxxxxxx>
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
---
 arch/x86/kvm/vmx/nested.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 9b0bfa2f854c..66a7b57c9f16 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -349,6 +349,7 @@ static void free_nested(struct kvm_vcpu *vcpu)
 
 	vmx->nested.vmxon = false;
 	vmx->nested.smm.vmxon = false;
+	vmx->nested.smm.guest_mode = false;
 	vmx->nested.vmxon_ptr = INVALID_GPA;
 	free_vpid(vmx->nested.vpid02);
 	vmx->nested.posted_intr_nv = -1;

base-commit: 164405e8e9a0378c7e1aff2254625a6553a291f1
-- 
2.56.0.257.gf7497c7d27-goog