leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
95e057e258
linux/arch
History
Wanpeng Li 95e057e258 KVM: X86: Fix SMRAM accessing even if VM is shutdown 
Reported by syzkaller:

   WARNING: CPU: 6 PID: 2434 at arch/x86/kvm/vmx.c:6660 handle_ept_misconfig+0x54/0x1e0 [kvm_intel]
   CPU: 6 PID: 2434 Comm: repro_test Not tainted 4.15.0+ #4
   RIP: 0010:handle_ept_misconfig+0x54/0x1e0 [kvm_intel]
   Call Trace:
    vmx_handle_exit+0xbd/0xe20 [kvm_intel]
    kvm_arch_vcpu_ioctl_run+0xdaf/0x1d50 [kvm]
    kvm_vcpu_ioctl+0x3e9/0x720 [kvm]
    do_vfs_ioctl+0xa4/0x6a0
    SyS_ioctl+0x79/0x90
    entry_SYSCALL_64_fastpath+0x25/0x9c

The testcase creates a first thread to issue KVM_SMI ioctl, and then creates
a second thread to mmap and operate on the same vCPU.  This triggers a race
condition when running the testcase with multiple threads. Sometimes one thread
exits with a triple fault while another thread mmaps and operates on the same
vCPU.  Because CS=0x3000/IP=0x8000 is not mapped, accessing the SMI handler
results in an EPT misconfig. This patch fixes it by returning RET_PF_EMULATE
in kvm_handle_bad_page(), which will go on to cause an emulation failure and an
exit with KVM_EXIT_INTERNAL_ERROR.

Reported-by: syzbot+c1d9517cab094dae65e446c0c5b4de6c40f4dc58@syzkaller.appspotmail.com
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-02-24 01:43:37 +01:00
..
alpha pci-v4.16-changes 2018-02-06 09:59:40 -08:00
arc The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
arm ARM: kvm: fix building with gcc-8 2018-02-15 20:58:36 +01:00
arm64 KVM changes for 4.16 2018-02-10 13:16:35 -08:00
blackfin unify {de,}mangle_poll(), get rid of kernel-side POLL... 2018-02-11 14:37:22 -08:00
c6x The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
cris vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
frv unify {de,}mangle_poll(), get rid of kernel-side POLL... 2018-02-11 14:37:22 -08:00
h8300 The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
hexagon The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
ia64 vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
m32r The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
m68k unify {de,}mangle_poll(), get rid of kernel-side POLL... 2018-02-11 14:37:22 -08:00
metag The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
microblaze Microblaze patches for 4.16-rc1 2018-02-02 09:48:36 -08:00
mips unify {de,}mangle_poll(), get rid of kernel-side POLL... 2018-02-11 14:37:22 -08:00
mn10300 The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
nios2 nios2 update for v4.16-rc1 2018-02-11 13:52:32 -08:00
openrisc The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
parisc The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
powerpc vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
riscv RISC-V changes for 4.16 2018-02-07 11:33:08 -08:00
s390 KVM: s390: provide only a single function for setting the tod (fix SCK) 2018-02-20 20:51:28 +00:00
score arch/score/kernel/setup.c: combine two seq_printf() calls into one call in show_cpuinfo() 2018-02-06 18:32:47 -08:00
sh libnvdimm for 4.16 2018-02-06 10:41:33 -08:00
sparc unify {de,}mangle_poll(), get rid of kernel-side POLL... 2018-02-11 14:37:22 -08:00
tile The core framework has a handful of patches this time around, mostly due 2018-02-01 16:56:07 -08:00
um mconsole_proc(): don't mess with file->f_pos 2018-02-09 19:28:01 -08:00
unicore32 lib: optimize cpumask_next_and() 2018-02-06 18:32:44 -08:00
x86 KVM: X86: Fix SMRAM accessing even if VM is shutdown 2018-02-24 01:43:37 +01:00
xtensa unify {de,}mangle_poll(), get rid of kernel-side POLL... 2018-02-11 14:37:22 -08:00
.gitignore
Kconfig Makefile: introduce CONFIG_CC_STACKPROTECTOR_AUTO 2018-02-06 18:32:44 -08:00