Re: [PATCH] vvmx: Fix uninitialised writeback to vmcs12

On 07.08.2026 11:32, Johann Höpfner wrote:
> nvmx_handle_vmwrite leaves local eight byte variable 'operand'
> uninitialised to be written as an out-parameter by decode_vmx_inst. In
> cases where the operand to vmwrite is a 32 bit memory operand, the
> invokation of  hvm_copy_from_guest_linear leaves the upper half of
> *poperandS uninitialised. The resulting eight byte value is consequently
> written to the vmcs12 leaking the four uninitialised bytes into guest
> physical memory.
> 
> Initialize the stack-space passed to decode_vmx_inst to avoid this
> issue.
> 
> Fixes: 2b2793d3ae44 ("nEPT: handle invept instruction from L1 VMM")
> Fixes: d4c5b9db5a85 ("Nested VMX: Emulation of guest VMWRITE")
> Fixes: 9ccf55307868 ("nVMX: virutalize VPID capability to nested VMM")
> Signed-off-by: Johann Höpfner <[email protected]>
> ---
> 
>> In any event - why don't you make your proposed change into a proper patch
>> (primary piece missing is your S-o-b, and perhaps we also would want a
>> suitable Fixes: tag)?
> 
> Sorry to have kept you waiting. Here is the formatted patch. I included
> the invvpid case still, though I believe only vmwrite remains after the
> patch you linked is merged, right?

I think so, yes. Andrew, Roger - any chance of coming to a conclusion on that
much earlier work [1]? Imo that wants to go in first, with the patch here then
shrunk to what's actually still needed (at which point only a single Fixes:
would be left as well).

Jan

[1] https://lists.xen.org/archives/html/xen-devel/2025-06/msg01208.html