leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
a80ced6ea5
linux/arch/x86/kvm
History
Yi Wang a80ced6ea5 KVM: SVM: fix panic on out-of-bounds guest IRQ 
As guest_irq is coming from KVM_IRQFD API call, it may trigger
crash in svm_update_pi_irte() due to out-of-bounds:

crash> bt
PID: 22218  TASK: ffff951a6ad74980  CPU: 73  COMMAND: "vcpu8"
 #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397
 #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d
 #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d
 #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d
 #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9
 #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51
 #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace
    [exception RIP: svm_update_pi_irte+227]
    RIP: ffffffffc0761b53  RSP: ffffb1ba6707fd08  RFLAGS: 00010086
    RAX: ffffb1ba6707fd78  RBX: ffffb1ba66d91000  RCX: 0000000000000001
    RDX: 00003c803f63f1c0  RSI: 000000000000019a  RDI: ffffb1ba66db2ab8
    RBP: 000000000000019a   R8: 0000000000000040   R9: ffff94ca41b82200
    R10: ffffffffffffffcf  R11: 0000000000000001  R12: 0000000000000001
    R13: 0000000000000001  R14: ffffffffffffffcf  R15: 000000000000005f
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm]
 #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm]
 #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm]
    RIP: 00007f143c36488b  RSP: 00007f143a4e04b8  RFLAGS: 00000246
    RAX: ffffffffffffffda  RBX: 00007f05780041d0  RCX: 00007f143c36488b
    RDX: 00007f05780041d0  RSI: 000000004008ae6a  RDI: 0000000000000020
    RBP: 00000000000004e8   R8: 0000000000000008   R9: 00007f05780041e0
    R10: 00007f0578004560  R11: 0000000000000246  R12: 00000000000004e0
    R13: 000000000000001a  R14: 00007f1424001c60  R15: 00007f0578003bc0
    ORIG_RAX: 0000000000000010  CS: 0033  SS: 002b

Vmx have been fix this in commit 3a8b0677fc (KVM: VMX: Do not BUG() on
out-of-bounds guest IRQ), so we can just copy source from that to fix
this.

Co-developed-by: Yi Liu <liu.yi24@zte.com.cn>
Signed-off-by: Yi Liu <liu.yi24@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Message-Id: <20220309113025.44469-1-wang.yi59@zte.com.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-04-02 05:34:38 -04:00
..
mmu KVM: MMU: propagate alloc_workqueue failure 2022-04-02 05:34:38 -04:00
svm KVM: SVM: fix panic on out-of-bounds guest IRQ 2022-04-02 05:34:38 -04:00
vmx Merge branch 'kvm-bugfixes' into HEAD 2022-03-04 18:39:29 -05:00
cpuid.c KVM: x86: Fix clang -Wimplicit-fallthrough in do_host_cpuid() 2022-03-29 13:21:18 -04:00
cpuid.h kvm: x86: Add support for getting/setting expanded xstate buffer 2022-01-14 13:44:41 -05:00
debugfs.c Merge branch 'kvm-pi-raw-spinlock' into HEAD 2022-01-19 12:14:02 -05:00
emulate.c KVM: x86/emulator: Move the unhandled outer privilege level logic of far return into __load_segment_descriptor() 2022-03-01 08:50:49 -05:00
fpu.h
hyperv.c KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated 2022-03-29 13:22:07 -04:00
hyperv.h KVM: x86: Make kvm_hv_hypercall_enabled() static inline 2022-02-10 13:50:44 -05:00
i8254.c KVM: Use 'unsigned long' as kvm_for_each_vcpu()'s index 2021-12-08 04:24:15 -05:00
i8254.h
i8259.c KVM: x86/i8259: Remove unused "addr" of elcr_ioport_{read,write}() 2022-02-10 13:47:12 -05:00
ioapic.c KVM: x86/ioapic: Remove unused "addr" and "length" of ioapic_read_indirect() 2022-02-10 13:47:13 -05:00
ioapic.h x86/kvm: remove unused ack_notifier callbacks 2021-11-18 07:05:57 -05:00
irq_comm.c KVM: x86/xen: Add KVM_IRQ_ROUTING_XEN_EVTCHN and event channel delivery 2022-01-07 10:44:45 -05:00
irq.c
irq.h x86/kvm: remove unused ack_notifier callbacks 2021-11-18 07:05:57 -05:00
Kconfig KVM: x86/mmu: Remove MMU auditing 2022-02-18 13:46:23 -05:00
kvm_cache_regs.h KVM: X86: Remove kvm_register_clear_available() 2021-12-08 04:25:03 -05:00
kvm_emulate.h KVM: x86: Update vPMCs when retiring branch instructions 2022-01-07 10:44:43 -05:00
kvm_onhyperv.c KVM: x86: Uninline and export hv_track_root_tdp() 2022-02-10 13:47:19 -05:00
kvm_onhyperv.h KVM: x86: Uninline and export hv_track_root_tdp() 2022-02-10 13:47:19 -05:00
lapic.c KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() 2022-03-29 13:22:01 -04:00
lapic.h KVM: x86: Make kvm_lapic_set_reg() a "private" xAPIC helper 2022-03-01 08:50:48 -05:00
Makefile KVM: Add Makefile.kvm for common files, use it for x86 2021-12-09 12:56:02 -05:00
mmu.h KVM: x86/mmu: Zap only obsolete roots if a root shadow page is zapped 2022-03-01 08:58:25 -05:00
mtrr.c
pmu.c KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW 2022-02-14 07:44:51 -05:00
pmu.h KVM: x86: Update vPMCs when retiring instructions 2022-01-07 10:44:42 -05:00
reverse_cpuid.h
trace.h KVM: x86: Make kvm_lapic_set_reg() a "private" xAPIC helper 2022-03-01 08:50:48 -05:00
tss.h
x86.c KVM: MMU: propagate alloc_workqueue failure 2022-04-02 05:34:38 -04:00
x86.h KVM: x86/mmu: Split huge pages mapped by the TDP MMU during KVM_CLEAR_DIRTY_LOG 2022-02-10 13:50:43 -05:00
xen.c KVM: xen: Use static_call() for invoking kvm_x86_ops hooks 2022-02-10 13:47:18 -05:00
xen.h KVM: x86/xen: Add KVM_IRQ_ROUTING_XEN_EVTCHN and event channel delivery 2022-01-07 10:44:45 -05:00