AZL-97085

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

Interaction between KVMCAPVMMOVEENCCONTEXTFROM and KVMCAPVMCOPYENCCONTEXTFROM can cause two separate issues:

• in sevmigratefrom(), when the destination KVM is a mirror, the mirror entry is moved from the source's list to the owner's mirrorvms list, without holding the owner's lock unlike other writers of the owner's mirror list (sevvmcopyenccontextfrom(), sevvmdestroy()). A concurrent COPY or destroy can race with sevmigratefrom() and corrupt the list.

• In sevvmdestroy(), the owner is still active and could receive concurrently a KVMCAPVMMOVEENCCONTEXTFROM that causes sev->enccontextowner to change. In this case the incorrect VM receives kvmputkvm().

The second issue needs particular care because the owner could disappear altogether (even though the race window is impossibly small) between reading it and locking it. There is thus no way to perform the checks under the owner lock without putting struct kvm under SLABTYPESAFEBYRCU (which would allow kvmgetkvmsafe() under RCU critical section).

It is much simpler to just use a global lock, since the critical sections are so small and the new lock is always a leaf lock.