leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
58c95070da
linux/arch
History
Paolo Bonzini 58c95070da KVM: x86: fix off-by-one in reserved bits check 
29ecd66019 ("KVM: x86: avoid uninitialized variable warning",
2015-09-06) introduced a not-so-subtle problem, which probably
escaped review because it was not part of the patch context.

Before the patch, leaf was always equal to iterator.level.  After,
it is equal to iterator.level - 1 in the call to is_shadow_zero_bits_set,
and when is_shadow_zero_bits_set does another "-1" the check on
reserved bits becomes incorrect.  Using "iterator.level" in the call
fixes this call trace:

WARNING: CPU: 2 PID: 17000 at arch/x86/kvm/mmu.c:3385 handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]()
Modules linked in: tun sha256_ssse3 sha256_generic drbg binfmt_misc ipv6 vfat fat fuse dm_crypt dm_mod kvm_amd kvm crc32_pclmul aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd fam15h_power amd64_edac_mod k10temp edac_core amdkfd amd_iommu_v2 radeon acpi_cpufreq
[...]
Call Trace:
  dump_stack+0x4e/0x84
  warn_slowpath_common+0x95/0xe0
  warn_slowpath_null+0x1a/0x20
  handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]
  tdp_page_fault+0x231/0x290 [kvm]
  ? emulator_pio_in_out+0x6e/0xf0 [kvm]
  kvm_mmu_page_fault+0x36/0x240 [kvm]
  ? svm_set_cr0+0x95/0xc0 [kvm_amd]
  pf_interception+0xde/0x1d0 [kvm_amd]
  handle_exit+0x181/0xa70 [kvm_amd]
  ? kvm_arch_vcpu_ioctl_run+0x68b/0x1730 [kvm]
  kvm_arch_vcpu_ioctl_run+0x6f6/0x1730 [kvm]
  ? kvm_arch_vcpu_ioctl_run+0x68b/0x1730 [kvm]
  ? preempt_count_sub+0x9b/0xf0
  ? mutex_lock_killable_nested+0x26f/0x490
  ? preempt_count_sub+0x9b/0xf0
  kvm_vcpu_ioctl+0x358/0x710 [kvm]
  ? __fget+0x5/0x210
  ? __fget+0x101/0x210
  do_vfs_ioctl+0x2f4/0x560
  ? __fget_light+0x29/0x90
  SyS_ioctl+0x4c/0x90
  entry_SYSCALL_64_fastpath+0x16/0x73
---[ end trace 37901c8686d84de6 ]---

Reported-by: Borislav Petkov <bp@alien8.de>
Tested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-09-25 10:31:29 +02:00
..
alpha dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
arc ARCv2: [axs103_smp] Reduce clk for SMP FPGA configs 2015-09-11 19:34:01 -07:00
arm Second set of KVM/ARM changes for 4.3-rc2 2015-09-17 16:51:59 +02:00
arm64 Second set of KVM/ARM changes for 4.3-rc2 2015-09-17 16:51:59 +02:00
avr32 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-09-03 15:46:07 -07:00
blackfin Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-09-03 15:46:07 -07:00
c6x Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-09-01 14:33:35 -07:00
cris CRISv10: delete unused lib/dmacopy.c 2015-09-05 00:56:51 +02:00
frv Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-09-03 15:46:07 -07:00
h8300 dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
hexagon Merge branch 'akpm' (patches from Andrew) 2015-09-10 18:19:42 -07:00
ia64 dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
m32r lib/decompressors: use real out buf size for gunzip with kernel 2015-09-10 13:29:01 -07:00
m68k kexec: split kexec_load syscall from kexec core code 2015-09-10 13:29:01 -07:00
metag Metag architecture changes for v4.3 2015-09-09 10:27:59 -07:00
microblaze Merge branch 'akpm' (patches from Andrew) 2015-09-10 18:19:42 -07:00
mips KVM: add halt_attempted_poll to VCPU stats 2015-09-16 12:17:00 +02:00
mn10300 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-09-03 15:46:07 -07:00
nios2 nios2: add Max10 defconfig 2015-09-08 18:16:02 +08:00
openrisc dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
parisc parisc: Use platform_device_register_simple("rtc-generic") 2015-09-08 17:53:48 +02:00
powerpc KVM: PPC: Book3S: Take the kvm->srcu lock in kvmppc_h_logical_ci_load/store() 2015-09-21 09:05:15 +10:00
s390 KVM: s390: Replace incorrect atomic_or with atomic_andnot 2015-09-16 17:01:06 +02:00
score Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-09-01 14:04:50 -07:00
sh dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
sparc dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
tile dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
um Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-09-01 14:04:50 -07:00
unicore32 dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
x86 KVM: x86: fix off-by-one in reserved bits check 2015-09-25 10:31:29 +02:00
xtensa dma-mapping: consolidate dma_set_mask 2015-09-10 13:29:01 -07:00
.gitignore
Kconfig kexec: split kexec_load syscall from kexec core code 2015-09-10 13:29:01 -07:00