* [PATCH v4.4.y] KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number
@ 2019-04-26 16:34 Zubin Mithra
2019-04-27 13:45 ` Sasha Levin
0 siblings, 1 reply; 2+ messages in thread
From: Zubin Mithra @ 2019-04-26 16:34 UTC (permalink / raw)
To: stable; +Cc: gregkh, groeck, pbonzini, rkrcmar, tglx, mingo, bp, hpa
From: Paolo Bonzini <pbonzini@redhat.com>
commit 78e546c824fa8f96d323b7edd6f5cad5b74af057 upstream
This cannot be returned by KVM_GET_VCPU_EVENTS, so it is okay to return
EINVAL. It causes a WARN from exception_type:
WARNING: CPU: 3 PID: 16732 at arch/x86/kvm/x86.c:345 exception_type+0x49/0x50 [kvm]()
CPU: 3 PID: 16732 Comm: a.out Tainted: G W 4.4.6-300.fc23.x86_64 #1
Hardware name: LENOVO 2325F51/2325F51, BIOS G2ET32WW (1.12 ) 05/30/2012
0000000000000286 000000006308a48b ffff8800bec7fcf8 ffffffff813b542e
0000000000000000 ffffffffa0966496 ffff8800bec7fd30 ffffffff810a40f2
ffff8800552a8000 0000000000000000 00000000002c267c 0000000000000001
Call Trace:
[<ffffffff813b542e>] dump_stack+0x63/0x85
[<ffffffff810a40f2>] warn_slowpath_common+0x82/0xc0
[<ffffffff810a423a>] warn_slowpath_null+0x1a/0x20
[<ffffffffa0924809>] exception_type+0x49/0x50 [kvm]
[<ffffffffa0934622>] kvm_arch_vcpu_ioctl_run+0x10a2/0x14e0 [kvm]
[<ffffffffa091c04d>] kvm_vcpu_ioctl+0x33d/0x620 [kvm]
[<ffffffff81241248>] do_vfs_ioctl+0x298/0x480
[<ffffffff812414a9>] SyS_ioctl+0x79/0x90
[<ffffffff817a04ee>] entry_SYSCALL_64_fastpath+0x12/0x71
---[ end trace b1a0391266848f50 ]---
Testcase (beautified/reduced from syzkaller output):
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/kvm.h>
long r[31];
int main()
{
memset(r, -1, sizeof(r));
r[2] = open("/dev/kvm", O_RDONLY);
r[3] = ioctl(r[2], KVM_CREATE_VM, 0);
r[7] = ioctl(r[3], KVM_CREATE_VCPU, 0);
struct kvm_vcpu_events ve = {
.exception.injected = 1,
.exception.nr = 0xd4
};
r[27] = ioctl(r[7], KVM_SET_VCPU_EVENTS, &ve);
r[30] = ioctl(r[7], KVM_RUN, 0);
return 0;
}
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Zubin Mithra <zsm@chromium.org>
---
Notes:
* Syzkaller triggered a WARNING in exception_type with the following stacktrace.
Call Trace:
__dump_stack lib/dump_stack.c:15 [inline]
dump_stack+0xbf/0x113 lib/dump_stack.c:51
panic+0x1a6/0x361 kernel/panic.c:116
__warn+0x168/0x1b0 kernel/panic.c:470
warn_slowpath_null+0x3c/0x40 kernel/panic.c:514
exception_type+0x33/0x7d arch/x86/kvm/x86.c:354
inject_pending_event arch/x86/kvm/x86.c:6072 [inline]
vcpu_enter_guest arch/x86/kvm/x86.c:6551 [inline]
vcpu_run arch/x86/kvm/x86.c:6744 [inline]
kvm_arch_vcpu_ioctl_run+0x1b76/0x352e arch/x86/kvm/x86.c:6902
kvm_vcpu_ioctl+0x396/0xa74 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2432
vfs_ioctl fs/ioctl.c:43 [inline]
do_vfs_ioctl+0xcb0/0xd0f fs/ioctl.c:630
SYSC_ioctl fs/ioctl.c:645 [inline]
SyS_ioctl+0x71/0xad fs/ioctl.c:636
entry_SYSCALL_64_fastpath+0x31/0xb3
* This patch resolves a conflict that arises when applying the original upstream
commit. The conflict arises as the following upstream patch was applied to 4.4.y:
28bf28887976 ("KVM: x86: fix user triggerable warning in kvm_apic_accept_events()")
* This commit is present in linux-4.9.y
* Tests run: Chrome OS tryjobs, Syzkaller reproducer
arch/x86/kvm/x86.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 706c5d63a53f..d830a0d60ba4 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2972,6 +2972,10 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
| KVM_VCPUEVENT_VALID_SMM))
return -EINVAL;
+ if (events->exception.injected &&
+ (events->exception.nr > 31 || events->exception.nr == NMI_VECTOR))
+ return -EINVAL;
+
/* INITs are latched while in SMM */
if (events->flags & KVM_VCPUEVENT_VALID_SMM &&
(events->smi.smm || events->smi.pending) &&
--
2.21.0.593.g511ec345e18-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v4.4.y] KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number
2019-04-26 16:34 [PATCH v4.4.y] KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number Zubin Mithra
@ 2019-04-27 13:45 ` Sasha Levin
0 siblings, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2019-04-27 13:45 UTC (permalink / raw)
To: Zubin Mithra
Cc: stable, gregkh, groeck, pbonzini, rkrcmar, tglx, mingo, bp, hpa
On Fri, Apr 26, 2019 at 09:34:01AM -0700, Zubin Mithra wrote:
>From: Paolo Bonzini <pbonzini@redhat.com>
>
>commit 78e546c824fa8f96d323b7edd6f5cad5b74af057 upstream
>
>This cannot be returned by KVM_GET_VCPU_EVENTS, so it is okay to return
>EINVAL. It causes a WARN from exception_type:
>
> WARNING: CPU: 3 PID: 16732 at arch/x86/kvm/x86.c:345 exception_type+0x49/0x50 [kvm]()
> CPU: 3 PID: 16732 Comm: a.out Tainted: G W 4.4.6-300.fc23.x86_64 #1
> Hardware name: LENOVO 2325F51/2325F51, BIOS G2ET32WW (1.12 ) 05/30/2012
> 0000000000000286 000000006308a48b ffff8800bec7fcf8 ffffffff813b542e
> 0000000000000000 ffffffffa0966496 ffff8800bec7fd30 ffffffff810a40f2
> ffff8800552a8000 0000000000000000 00000000002c267c 0000000000000001
> Call Trace:
> [<ffffffff813b542e>] dump_stack+0x63/0x85
> [<ffffffff810a40f2>] warn_slowpath_common+0x82/0xc0
> [<ffffffff810a423a>] warn_slowpath_null+0x1a/0x20
> [<ffffffffa0924809>] exception_type+0x49/0x50 [kvm]
> [<ffffffffa0934622>] kvm_arch_vcpu_ioctl_run+0x10a2/0x14e0 [kvm]
> [<ffffffffa091c04d>] kvm_vcpu_ioctl+0x33d/0x620 [kvm]
> [<ffffffff81241248>] do_vfs_ioctl+0x298/0x480
> [<ffffffff812414a9>] SyS_ioctl+0x79/0x90
> [<ffffffff817a04ee>] entry_SYSCALL_64_fastpath+0x12/0x71
> ---[ end trace b1a0391266848f50 ]---
>
>Testcase (beautified/reduced from syzkaller output):
>
> #include <unistd.h>
> #include <sys/syscall.h>
> #include <string.h>
> #include <stdint.h>
> #include <fcntl.h>
> #include <sys/ioctl.h>
> #include <linux/kvm.h>
>
> long r[31];
>
> int main()
> {
> memset(r, -1, sizeof(r));
> r[2] = open("/dev/kvm", O_RDONLY);
> r[3] = ioctl(r[2], KVM_CREATE_VM, 0);
> r[7] = ioctl(r[3], KVM_CREATE_VCPU, 0);
>
> struct kvm_vcpu_events ve = {
> .exception.injected = 1,
> .exception.nr = 0xd4
> };
> r[27] = ioctl(r[7], KVM_SET_VCPU_EVENTS, &ve);
> r[30] = ioctl(r[7], KVM_RUN, 0);
> return 0;
> }
>
>Reported-by: Dmitry Vyukov <dvyukov@google.com>
>Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
>Signed-off-by: Zubin Mithra <zsm@chromium.org>
>---
>Notes:
>* Syzkaller triggered a WARNING in exception_type with the following stacktrace.
>Call Trace:
> __dump_stack lib/dump_stack.c:15 [inline]
> dump_stack+0xbf/0x113 lib/dump_stack.c:51
> panic+0x1a6/0x361 kernel/panic.c:116
> __warn+0x168/0x1b0 kernel/panic.c:470
> warn_slowpath_null+0x3c/0x40 kernel/panic.c:514
> exception_type+0x33/0x7d arch/x86/kvm/x86.c:354
> inject_pending_event arch/x86/kvm/x86.c:6072 [inline]
> vcpu_enter_guest arch/x86/kvm/x86.c:6551 [inline]
> vcpu_run arch/x86/kvm/x86.c:6744 [inline]
> kvm_arch_vcpu_ioctl_run+0x1b76/0x352e arch/x86/kvm/x86.c:6902
> kvm_vcpu_ioctl+0x396/0xa74 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2432
> vfs_ioctl fs/ioctl.c:43 [inline]
> do_vfs_ioctl+0xcb0/0xd0f fs/ioctl.c:630
> SYSC_ioctl fs/ioctl.c:645 [inline]
> SyS_ioctl+0x71/0xad fs/ioctl.c:636
> entry_SYSCALL_64_fastpath+0x31/0xb3
>
>* This patch resolves a conflict that arises when applying the original upstream
>commit. The conflict arises as the following upstream patch was applied to 4.4.y:
> 28bf28887976 ("KVM: x86: fix user triggerable warning in kvm_apic_accept_events()")
>
>* This commit is present in linux-4.9.y
>
>* Tests run: Chrome OS tryjobs, Syzkaller reproducer
Queued, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-04-27 13:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-04-26 16:34 [PATCH v4.4.y] KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number Zubin Mithra
2019-04-27 13:45 ` Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox