From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x226ObQLAmhXObTeench2wqe7VNXBbSVH+XvwlbvTVuK4T/4JR6FOkct53eh6SHJhFY9rQYQ8 ARC-Seal: i=1; a=rsa-sha256; t=1519411370; cv=none; d=google.com; s=arc-20160816; b=rnmj0qgrRmuPgPTvRTiWVcVzqAjzbGZrZdVdwHrS7aIeXomkJjII6Bc7J6IINm46an 0dAoH2rrTYhJ4f9NqgkomPWKifT/3h+z8MpOkpGGM/JNlJSFi2jBvk6Hmq/Fa/w4jXYI TQ+KeT+qAddet8OqbFpRDYOd2EoJE7ve82dnB/uKU0A3OSoamkmtBH+wPD9jpKntDctC FYTW0ejDD6gSbbHQgQkRvfhqziY4UeFH98bDDYH9GKVUxw3BU53pzvKWfvME4zSE1ba1 kXznazdTZg0NqgFgLnLPMQGUTeY/VlMdrFpdz9whCTV7Ik2yQdsXvmY9koykGz+SJlZt FD2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=/4gbq7lyhN7nxaoCc09CEiIkuryznD8q9x3mOIzVihY=; b=pubd+2z5DzgBGbNbxhY8vfe7BY3UWlqvO0urLVadKkwUvtCHpHm9SqO1J/9cXQ5P6Z weXTVyVxlO2A5P/sKBg4VuLIVvrsUvAAVaX+Bs5Drq0ItwSKeZJXpDpIZpheOj80/KZi 1mFbQvH4jUrTUyDxHPR+uwDmXw+KoiKYh9pHIFAwzwgfG8KMUf30+Z+XeizK3AIC2b4p +i0GeFtrp4R/+boM1Itt/F1B7f7TkBw8oFnPfCWjv7HU4lz+LDi+7jtkbc622lwPfb7S VAh5JAZ5HkrD2X9XQoq+jjh64GfEabEF83zgSYUZU2muJ58Wjxop6KbjZbfdhCf1qPVq e3vw== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Vyukov , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , David Hildenbrand , Wanpeng Li Subject: [PATCH 4.9 020/145] KVM: x86: fix escape of guest dr6 to the host Date: Fri, 23 Feb 2018 19:25:26 +0100 Message-Id: <20180223170727.299653745@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170724.669759283@linuxfoundation.org> References: <20180223170724.669759283@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1593217684161240424?= X-GMAIL-MSGID: =?utf-8?q?1593218297013074401?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wanpeng Li commit efdab992813fb2ed825745625b83c05032e9cda2 upstream. syzkaller reported: WARNING: CPU: 0 PID: 12927 at arch/x86/kernel/traps.c:780 do_debug+0x222/0x250 CPU: 0 PID: 12927 Comm: syz-executor Tainted: G OE 4.15.0-rc2+ #16 RIP: 0010:do_debug+0x222/0x250 Call Trace: <#DB> debug+0x3e/0x70 RIP: 0010:copy_user_enhanced_fast_string+0x10/0x20 _copy_from_user+0x5b/0x90 SyS_timer_create+0x33/0x80 entry_SYSCALL_64_fastpath+0x23/0x9a The testcase sets a watchpoint (with perf_event_open) on a buffer that is passed to timer_create() as the struct sigevent argument. In timer_create(), copy_from_user()'s rep movsb triggers the BP. The testcase also sets the debug registers for the guest. However, KVM only restores host debug registers when the host has active watchpoints, which triggers a race condition when running the testcase with multiple threads. The guest's DR6.BS bit can escape to the host before another thread invokes timer_create(), and do_debug() complains. The fix is to respect do_debug()'s dr6 invariant when leaving KVM. Reported-by: Dmitry Vyukov Cc: Paolo Bonzini Cc: Radim Krčmář Cc: David Hildenbrand Cc: Dmitry Vyukov Reviewed-by: David Hildenbrand Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini Signed-off-by: Radim Krčmář Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/x86.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -2847,6 +2847,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu * kvm_x86_ops->vcpu_put(vcpu); kvm_put_guest_fpu(vcpu); vcpu->arch.last_host_tsc = rdtsc(); + /* + * If userspace has set any breakpoints or watchpoints, dr6 is restored + * on every vmexit, but if not, we might have a stale dr6 from the + * guest. do_debug expects dr6 to be cleared after it runs, do the same. + */ + set_debugreg(0, 6); } static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu,