Re: [PATCH v3] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

[Omar Sandoval <osandov@osandov.com>]

On Tue, Nov 18, 2025 at 03:33:30PM -0800, Sean Christopherson wrote:
> On Tue, Nov 18, 2025, Omar Sandoval wrote:
> > On Tue, Nov 04, 2025 at 09:55:26AM -0800, Omar Sandoval wrote:
> > > From: Omar Sandoval <osandov@fb.com>
> > > 
> > > When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn
> > > instruction, discard the exception and retry the instruction if the code
> > > stream is changed (e.g. by a different vCPU) between when the CPU
> > > executes the instruction and when KVM decodes the instruction to get the
> > > next RIP.
> > > 
> > > As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject
> > > INT3/INTO instead of retrying the instruction"), failure to verify that
> > > the correct INTn instruction was decoded can effectively clobber guest
> > > state due to decoding the wrong instruction and thus specifying the
> > > wrong next RIP.
> > > 
> > > The bug most often manifests as "Oops: int3" panics on static branch
> > > checks in Linux guests.  Enabling or disabling a static branch in Linux
> > > uses the kernel's "text poke" code patching mechanism.  To modify code
> > > while other CPUs may be executing that code, Linux (temporarily)
> > > replaces the first byte of the original instruction with an int3 (opcode
> > > 0xcc), then patches in the new code stream except for the first byte,
> > > and finally replaces the int3 with the first byte of the new code
> > > stream.  If a CPU hits the int3, i.e. executes the code while it's being
> > > modified, then the guest kernel must look up the RIP to determine how to
> > > handle the #BP, e.g. by emulating the new instruction.  If the RIP is
> > > incorrect, then this lookup fails and the guest kernel panics.
> > > 
> > > The bug reproduces almost instantly by hacking the guest kernel to
> > > repeatedly check a static branch[1] while running a drgn script[2] on
> > > the host to constantly swap out the memory containing the guest's TSS.
> > > 
> > > [1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a
> > > [2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b
> > > 
> > > Fixes: 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction")
> > > Cc: stable@vger.kernel.org
> > > Co-developed-by: Sean Christopherson <seanjc@google.com>
> > > Signed-off-by: Sean Christopherson <seanjc@google.com>
> > > Signed-off-by: Omar Sandoval <osandov@fb.com>
> > > ---
> > > Changes from v2 (https://lore.kernel.org/all/6ab4e8e5c5d6ea95f568a1ff8044779137dce428.1761774582.git.osandov@fb.com/):
> > > 
> > > - Fixed EMULTYPE_SET_SOFT_INT_VECTOR -> EMULTYPE_GET_SOFT_INT_VECTOR
> > >   typo.
> > > - Added explicit u32 cast to EMULTYPE_SET_SOFT_INT_VECTOR to make it
> > >   clear that it won't overflow.
> > > - Rebased on Linus's tree as of c9cfc122f03711a5124b4aafab3211cf4d35a2ac.
> > > 
> > >  arch/x86/include/asm/kvm_host.h |  9 +++++++++
> > >  arch/x86/kvm/svm/svm.c          | 24 +++++++++++++-----------
> > >  arch/x86/kvm/x86.c              | 21 +++++++++++++++++++++
> > >  3 files changed, 43 insertions(+), 11 deletions(-)
> > 
> > Ping, does this need any more updates?
> 
> For the record, I had this applied and tested before the ping, I just hadn't sent
> the "thank you" yet.  :-D
> 
> commit 4da3768e1820cf15cced390242d8789aed34f54d
> Author:     Omar Sandoval <osandov@fb.com>
> AuthorDate: Tue Nov 4 09:55:26 2025 -0800
> Commit:     Sean Christopherson <seanjc@google.com>
> CommitDate: Thu Nov 13 13:03:19 2025 -0800  <======= See, I'm not lying!

No worries, and thanks! I checked
git://git.kernel.org/pub/scm/virt/kvm/kvm.git before pinging, but not
https://github.com/kvm-x86/linux. I appreciate the help with this!

Omar