Re: [PATCH v3] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

[Sean Christopherson <seanjc@google.com>]

On Tue, Nov 18, 2025, Omar Sandoval wrote:
> On Tue, Nov 04, 2025 at 09:55:26AM -0800, Omar Sandoval wrote:
> > From: Omar Sandoval <osandov@fb.com>
> > 
> > When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn
> > instruction, discard the exception and retry the instruction if the code
> > stream is changed (e.g. by a different vCPU) between when the CPU
> > executes the instruction and when KVM decodes the instruction to get the
> > next RIP.
> > 
> > As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject
> > INT3/INTO instead of retrying the instruction"), failure to verify that
> > the correct INTn instruction was decoded can effectively clobber guest
> > state due to decoding the wrong instruction and thus specifying the
> > wrong next RIP.
> > 
> > The bug most often manifests as "Oops: int3" panics on static branch
> > checks in Linux guests.  Enabling or disabling a static branch in Linux
> > uses the kernel's "text poke" code patching mechanism.  To modify code
> > while other CPUs may be executing that code, Linux (temporarily)
> > replaces the first byte of the original instruction with an int3 (opcode
> > 0xcc), then patches in the new code stream except for the first byte,
> > and finally replaces the int3 with the first byte of the new code
> > stream.  If a CPU hits the int3, i.e. executes the code while it's being
> > modified, then the guest kernel must look up the RIP to determine how to
> > handle the #BP, e.g. by emulating the new instruction.  If the RIP is
> > incorrect, then this lookup fails and the guest kernel panics.
> > 
> > The bug reproduces almost instantly by hacking the guest kernel to
> > repeatedly check a static branch[1] while running a drgn script[2] on
> > the host to constantly swap out the memory containing the guest's TSS.
> > 
> > [1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a
> > [2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b
> > 
> > Fixes: 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction")
> > Cc: stable@vger.kernel.org
> > Co-developed-by: Sean Christopherson <seanjc@google.com>
> > Signed-off-by: Sean Christopherson <seanjc@google.com>
> > Signed-off-by: Omar Sandoval <osandov@fb.com>
> > ---
> > Changes from v2 (https://lore.kernel.org/all/6ab4e8e5c5d6ea95f568a1ff8044779137dce428.1761774582.git.osandov@fb.com/):
> > 
> > - Fixed EMULTYPE_SET_SOFT_INT_VECTOR -> EMULTYPE_GET_SOFT_INT_VECTOR
> >   typo.
> > - Added explicit u32 cast to EMULTYPE_SET_SOFT_INT_VECTOR to make it
> >   clear that it won't overflow.
> > - Rebased on Linus's tree as of c9cfc122f03711a5124b4aafab3211cf4d35a2ac.
> > 
> >  arch/x86/include/asm/kvm_host.h |  9 +++++++++
> >  arch/x86/kvm/svm/svm.c          | 24 +++++++++++++-----------
> >  arch/x86/kvm/x86.c              | 21 +++++++++++++++++++++
> >  3 files changed, 43 insertions(+), 11 deletions(-)
> 
> Ping, does this need any more updates?

For the record, I had this applied and tested before the ping, I just hadn't sent
the "thank you" yet.  :-D

commit 4da3768e1820cf15cced390242d8789aed34f54d
Author:     Omar Sandoval <osandov@fb.com>
AuthorDate: Tue Nov 4 09:55:26 2025 -0800
Commit:     Sean Christopherson <seanjc@google.com>
CommitDate: Thu Nov 13 13:03:19 2025 -0800  <======= See, I'm not lying!