From: <wang.yi59@zte.com.cn>
To: <pbonzini@redhat.com>
Cc: <seanjc@google.com>, <vkuznets@redhat.com>,
<wanpengli@tencent.com>, <jmattson@google.com>, <joro@8bytes.org>,
<tglx@linutronix.de>, <mingo@redhat.com>, <bp@alien8.de>,
<dave.hansen@linux.intel.com>, <x86@kernel.org>, <hpa@zytor.com>,
<kvm@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<xue.zhihong@zte.com.cn>, <up2wing@gmail.com>,
<wang.liang82@zte.com.cn>, <liu.yi24@zte.com.cn>
Subject: Re:[PATCH] KVM: SVM: fix panic on out-of-bounds guest IRQ
Date: Wed, 9 Mar 2022 18:27:56 +0800 (CST) [thread overview]
Message-ID: <202203091827565144689@zte.com.cn> (raw)
In-Reply-To: <2bd92846-381b-f083-754a-89dfcdccc90c@redhat.com>
Hi Paolo,
> On 3/9/22 12:30, Yi Wang wrote:
> > As guest_irq is coming from KVM_IRQFD API call, it may trigger
> > crash in svm_update_pi_irte() due to out-of-bounds:
> >
> > crash> bt
> > PID: 22218 TASK: ffff951a6ad74980 CPU: 73 COMMAND: "vcpu8"
> > #0 [ffffb1ba6707fa40] machine_kexec at ffffffff8565b397
> > #1 [ffffb1ba6707fa90] __crash_kexec at ffffffff85788a6d
> > #2 [ffffb1ba6707fb58] crash_kexec at ffffffff8578995d
> > #3 [ffffb1ba6707fb70] oops_end at ffffffff85623c0d
> > #4 [ffffb1ba6707fb90] no_context at ffffffff856692c9
> > #5 [ffffb1ba6707fbf8] exc_page_fault at ffffffff85f95b51
> > #6 [ffffb1ba6707fc50] asm_exc_page_fault at ffffffff86000ace
> > [exception RIP: svm_update_pi_irte+227]
> > RIP: ffffffffc0761b53 RSP: ffffb1ba6707fd08 RFLAGS: 00010086
> > RAX: ffffb1ba6707fd78 RBX: ffffb1ba66d91000 RCX: 0000000000000001
> > RDX: 00003c803f63f1c0 RSI: 000000000000019a RDI: ffffb1ba66db2ab8
> > RBP: 000000000000019a R8: 0000000000000040 R9: ffff94ca41b82200
> > R10: ffffffffffffffcf R11: 0000000000000001 R12: 0000000000000001
> > R13: 0000000000000001 R14: ffffffffffffffcf R15: 000000000000005f
> > ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
> > #7 [ffffb1ba6707fdb8] kvm_irq_routing_update at ffffffffc09f19a1 [kvm]
> > #8 [ffffb1ba6707fde0] kvm_set_irq_routing at ffffffffc09f2133 [kvm]
> > #9 [ffffb1ba6707fe18] kvm_vm_ioctl at ffffffffc09ef544 [kvm]
> > #10 [ffffb1ba6707ff10] __x64_sys_ioctl at ffffffff85935474
> > #11 [ffffb1ba6707ff40] do_syscall_64 at ffffffff85f921d3
> > #12 [ffffb1ba6707ff50] entry_SYSCALL_64_after_hwframe at ffffffff8600007c
> > RIP: 00007f143c36488b RSP: 00007f143a4e04b8 RFLAGS: 00000246
> > RAX: ffffffffffffffda RBX: 00007f05780041d0 RCX: 00007f143c36488b
> > RDX: 00007f05780041d0 RSI: 000000004008ae6a RDI: 0000000000000020
> > RBP: 00000000000004e8 R8: 0000000000000008 R9: 00007f05780041e0
> > R10: 00007f0578004560 R11: 0000000000000246 R12: 00000000000004e0
> > R13: 000000000000001a R14: 00007f1424001c60 R15: 00007f0578003bc0
> > ORIG_RAX: 0000000000000010 CS: 0033 SS: 002b
> >
> > Vmx have been fix this in commit 3a8b0677fc61 (KVM: VMX: Do not BUG() on
> > out-of-bounds guest IRQ), so we can just copy source from that to fix
> > this.
> >
> > Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
> > Signed-off-by: Yi Liu <liu.yi24@zte.com.cn>
>
> Hi, the Signed-off-by chain is wrong. Did Yi Liu write the patch (and
> you are just sending it)?
The Signed-off-by chain is not wrong, I (Yi Wang) wrote this patch and Yi Liu
co-developed it.
>
> Paolo
next prev parent reply other threads:[~2022-03-09 10:28 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-09 11:30 [PATCH] KVM: SVM: fix panic on out-of-bounds guest IRQ Yi Wang
2022-03-09 9:01 ` Paolo Bonzini
2022-03-09 10:27 ` wang.yi59 [this message]
2022-03-09 11:02 ` Paolo Bonzini
2022-03-10 3:12 ` wang.yi59
2022-03-09 12:17 ` [PATCH] " Borislav Petkov
2022-03-10 3:17 ` wang.yi59
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202203091827565144689@zte.com.cn \
--to=wang.yi59@zte.com.cn \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=liu.yi24@zte.com.cn \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=tglx@linutronix.de \
--cc=up2wing@gmail.com \
--cc=vkuznets@redhat.com \
--cc=wang.liang82@zte.com.cn \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
--cc=xue.zhihong@zte.com.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox