From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Jack Wang <jinpu.wang@cloud.ionos.com>,
Paolo Bonzini <pbonzini@redhat.com>
Subject: [PATCH 4.14 07/61] KVM: nVMX: handle page fault in vmread fix
Date: Thu, 10 Oct 2019 10:36:32 +0200 [thread overview]
Message-ID: <20191010083453.935844488@linuxfoundation.org> (raw)
In-Reply-To: <20191010083449.500442342@linuxfoundation.org>
From: Jack Wang <jinpu.wang@cloud.ionos.com>
During backport f7eea636c3d5 ("KVM: nVMX: handle page fault in vmread"),
there was a mistake the exception reference should be passed to function
kvm_write_guest_virt_system, instead of NULL, other wise, we will get
NULL pointer deref, eg
kvm-unit-test triggered a NULL pointer deref below:
[ 948.518437] kvm [24114]: vcpu0, guest rIP: 0x407ef9 kvm_set_msr_common: MSR_IA32_DEBUGCTLMSR 0x3, nop
[ 949.106464] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[ 949.106707] PGD 0 P4D 0
[ 949.106872] Oops: 0002 [#1] SMP
[ 949.107038] CPU: 2 PID: 24126 Comm: qemu-2.7 Not tainted 4.19.77-pserver #4.19.77-1+feature+daily+update+20191005.1625+a4168bb~deb9
[ 949.107283] Hardware name: Dell Inc. Precision Tower 3620/09WH54, BIOS 2.7.3 01/31/2018
[ 949.107549] RIP: 0010:kvm_write_guest_virt_system+0x12/0x40 [kvm]
[ 949.107719] Code: c0 5d 41 5c 41 5d 41 5e 83 f8 03 41 0f 94 c0 41 c1 e0 02 e9 b0 ed ff ff 0f 1f 44 00 00 48 89 f0 c6 87 59 56 00 00 01 48 89 d6 <49> c7 00 00 00 00 00 89 ca 49 c7 40 08 00 00 00 00 49 c7 40 10 00
[ 949.108044] RSP: 0018:ffffb31b0a953cb0 EFLAGS: 00010202
[ 949.108216] RAX: 000000000046b4d8 RBX: ffff9e9f415b0000 RCX: 0000000000000008
[ 949.108389] RDX: ffffb31b0a953cc0 RSI: ffffb31b0a953cc0 RDI: ffff9e9f415b0000
[ 949.108562] RBP: 00000000d2e14928 R08: 0000000000000000 R09: 0000000000000000
[ 949.108733] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffffffffc8
[ 949.108907] R13: 0000000000000002 R14: ffff9e9f4f26f2e8 R15: 0000000000000000
[ 949.109079] FS: 00007eff8694c700(0000) GS:ffff9e9f51a80000(0000) knlGS:0000000031415928
[ 949.109318] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 949.109495] CR2: 0000000000000000 CR3: 00000003be53b002 CR4: 00000000003626e0
[ 949.109671] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 949.109845] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 949.110017] Call Trace:
[ 949.110186] handle_vmread+0x22b/0x2f0 [kvm_intel]
[ 949.110356] ? vmexit_fill_RSB+0xc/0x30 [kvm_intel]
[ 949.110549] kvm_arch_vcpu_ioctl_run+0xa98/0x1b30 [kvm]
[ 949.110725] ? kvm_vcpu_ioctl+0x388/0x5d0 [kvm]
[ 949.110901] kvm_vcpu_ioctl+0x388/0x5d0 [kvm]
[ 949.111072] do_vfs_ioctl+0xa2/0x620
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
---
arch/x86/kvm/vmx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8026,7 +8026,7 @@ static int handle_vmread(struct kvm_vcpu
/* _system ok, nested_vmx_check_permission has verified cpl=0 */
if (kvm_write_guest_virt_system(vcpu, gva, &field_value,
(is_long_mode(vcpu) ? 8 : 4),
- NULL))
+ &e))
kvm_inject_page_fault(vcpu, &e);
}
next prev parent reply other threads:[~2019-10-10 8:50 UTC|newest]
Thread overview: 73+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-10 8:36 [PATCH 4.14 00/61] 4.14.149-stable review Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 01/61] s390/process: avoid potential reading of freed stack Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 02/61] KVM: s390: Test for bad access register and size at the start of S390_MEM_OP Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 03/61] s390/topology: avoid firing events before kobjs are created Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 04/61] s390/cio: avoid calling strlen on null pointer Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 05/61] s390/cio: exclude subchannels with no parent from pseudo check Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 06/61] KVM: PPC: Book3S HV: Dont lose pending doorbell request on migration on P9 Greg Kroah-Hartman
2019-10-10 8:36 ` Greg Kroah-Hartman [this message]
2019-10-10 8:36 ` [PATCH 4.14 08/61] PM / devfreq: tegra: Fix kHz to Hz conversion Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 09/61] ASoC: Define a set of DAPM pre/post-up events Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 10/61] powerpc/powernv: Restrict OPAL symbol map to only be readable by root Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 11/61] can: mcp251x: mcp251x_hw_reset(): allow more time after a reset Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 12/61] tools lib traceevent: Fix "robust" test of do_generate_dynamic_list_file Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 13/61] crypto: qat - Silence smp_processor_id() warning Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 14/61] crypto: skcipher - Unmap pages after an external error Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 15/61] crypto: cavium/zip - Add missing single_release() Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 16/61] crypto: caam - fix concurrency issue in givencrypt descriptor Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 17/61] MIPS: Treat Loongson Extensions as ASEs Greg Kroah-Hartman
2019-10-11 4:30 ` Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 18/61] usercopy: Avoid HIGHMEM pfn warning Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 19/61] timer: Read jiffies once when forwarding base clk Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 20/61] watchdog: imx2_wdt: fix min() calculation in imx2_wdt_set_timeout Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 21/61] drm/omap: fix max fclk divider for omap36xx Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 22/61] mmc: sdhci: improve ADMA error reporting Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 23/61] mmc: sdhci-of-esdhc: set DMA snooping based on DMA coherence Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 24/61] Revert "locking/pvqspinlock: Dont wait if vCPU is preempted" Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 25/61] xen/xenbus: fix self-deadlock after killing user process Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 26/61] ieee802154: atusb: fix use-after-free at disconnect Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 27/61] cfg80211: initialize on-stack chandefs Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 28/61] ima: always return negative code for error Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 29/61] fs: nfs: Fix possible null-pointer dereferences in encode_attrs() Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 30/61] 9p: avoid attaching writeback_fid on mmap with type PRIVATE Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 31/61] xen/pci: reserve MCFG areas earlier Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 32/61] ceph: fix directories inode i_blkbits initialization Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 33/61] ceph: reconnect connection if session hang in opening state Greg Kroah-Hartman
2019-10-10 8:36 ` [PATCH 4.14 34/61] watchdog: aspeed: Add support for AST2600 Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 35/61] netfilter: nf_tables: allow lookups in dynamic sets Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 36/61] drm/amdgpu: Check for valid number of registers to read Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 37/61] pNFS: Ensure we do clear the return-on-close layout stateid on fatal errors Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 38/61] pwm: stm32-lp: Add check in case requested period cannot be achieved Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 39/61] thermal: Fix use-after-free when unregistering thermal zone device Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 40/61] fuse: fix memleak in cuse_channel_open Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 41/61] sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr() Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 42/61] perf build: Add detection of java-11-openjdk-devel package Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 43/61] kernel/elfcore.c: include proper prototypes Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 44/61] perf unwind: Fix libunwind build failure on i386 systems Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 45/61] KVM: PPC: Book3S HV: XIVE: Free escalation interrupts before disabling the VP Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 46/61] nbd: fix crash when the blksize is zero Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 47/61] block/ndb: add WQ_UNBOUND to the knbd-recv workqueue Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 48/61] nbd: fix max number of supported devs Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 49/61] powerpc/pseries: Fix cpu_hotplug_lock acquisition in resize_hpt() Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 50/61] tools lib traceevent: Do not free tep->cmdlines in add_new_comm() on failure Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 51/61] tick: broadcast-hrtimer: Fix a race in bc_set_next Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 53/61] perf stat: Fix a segmentation fault when using repeat forever Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 54/61] perf stat: Reset previous counts on repeat with interval Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 55/61] drm/i915/userptr: Acquire the page lock around set_page_dirty() Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 56/61] vfs: Fix EOVERFLOW testing in put_compat_statfs64 Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 57/61] coresight: etm4x: Use explicit barriers on enable/disable Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 58/61] cfg80211: add and use strongly typed element iteration macros Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 59/61] cfg80211: Use const more consistently in for_each_element macros Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 60/61] nl80211: validate beacon head Greg Kroah-Hartman
2019-10-10 8:37 ` [PATCH 4.14 61/61] ASoC: sgtl5000: Improve VAG power and mute control Greg Kroah-Hartman
2019-10-10 13:27 ` [PATCH 4.14 00/61] 4.14.149-stable review Naresh Kamboju
2019-10-10 14:21 ` kernelci.org bot
2019-10-10 17:12 ` Guenter Roeck
2019-10-11 4:29 ` Greg Kroah-Hartman
2019-10-11 13:14 ` Guenter Roeck
2019-10-11 14:01 ` Greg Kroah-Hartman
2019-10-10 22:18 ` Guenter Roeck
2019-10-10 23:50 ` Didik Setiawan
2019-10-11 3:09 ` shuah
2019-10-11 8:33 ` Jon Hunter
2019-10-11 8:33 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191010083453.935844488@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jinpu.wang@cloud.ionos.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.