From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A50FC3A5A9 for ; Wed, 4 Sep 2019 18:18:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 378AF206B8 for ; Wed, 4 Sep 2019 18:18:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567621080; bh=NGDQCyVycC9SA+WJSA2hJ2rHFe5sjCV3JCNMe92DowI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=N5QlDSISy8TYeX2IyVlfO68UXsgEnIEmcH6HBihF1sMl9OmdgRGivKcXC/3+rCcaC UqSi2xM5qNXrEUdxqb8EPl5hwBiZc7li+N0q5BaVSfkyzy7AIisQEuvNSD9lQHo8A2 qfWksve69sXNcFG3wPgLBEaqFfDmfg9gyTxD+coY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389273AbfIDSLv (ORCPT ); Wed, 4 Sep 2019 14:11:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:56036 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389206AbfIDSLv (ORCPT ); Wed, 4 Sep 2019 14:11:51 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D68992087E; Wed, 4 Sep 2019 18:11:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567620710; bh=NGDQCyVycC9SA+WJSA2hJ2rHFe5sjCV3JCNMe92DowI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XD9Pu69NpTj5ahsxklOSmf1ChdECvOJUvL3zPk3ES0JVdIf6Y6XirfGvO89+Nye/R ncV3PNGBRUudLMzrOHXnoL4hZK25/aMWMAhJo/hZwM/u7GzGLtnMHAcADRurPCxzqy L0AvMgWvkRPffZvz+3gpoGNO9QEr9vnDxqcTN1lY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Radim Krcmar , Bandan Das , Paolo Bonzini Subject: [PATCH 5.2 067/143] kvm: x86: skip populating logical dest map if apic is not sw enabled Date: Wed, 4 Sep 2019 19:53:30 +0200 Message-Id: <20190904175316.688032395@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190904175314.206239922@linuxfoundation.org> References: <20190904175314.206239922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Radim Krcmar commit b14c876b994f208b6b95c222056e1deb0a45de0e upstream. recalculate_apic_map does not santize ldr and it's possible that multiple bits are set. In that case, a previous valid entry can potentially be overwritten by an invalid one. This condition is hit when booting a 32 bit, >8 CPU, RHEL6 guest and then triggering a crash to boot a kdump kernel. This is the sequence of events: 1. Linux boots in bigsmp mode and enables PhysFlat, however, it still writes to the LDR which probably will never be used. 2. However, when booting into kdump, the stale LDR values remain as they are not cleared by the guest and there isn't a apic reset. 3. kdump boots with 1 cpu, and uses Logical Destination Mode but the logical map has been overwritten and points to an inactive vcpu. Signed-off-by: Radim Krcmar Signed-off-by: Bandan Das Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/lapic.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -212,6 +212,9 @@ static void recalculate_apic_map(struct if (!apic_x2apic_mode(apic) && !new->phys_map[xapic_id]) new->phys_map[xapic_id] = apic; + if (!kvm_apic_sw_enabled(apic)) + continue; + ldr = kvm_lapic_get_reg(apic, APIC_LDR); if (apic_x2apic_mode(apic)) { @@ -254,6 +257,8 @@ static inline void apic_set_spiv(struct static_key_slow_dec_deferred(&apic_sw_disabled); else static_key_slow_inc(&apic_sw_disabled.key); + + recalculate_apic_map(apic->vcpu->kvm); } }