Re: [PATCH 6.1.y 2/2] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

[Sean Christopherson <seanjc@google.com>]

On Mon, Dec 08, 2025, Sasha Levin wrote:
> From: Omar Sandoval <osandov@fb.com>
> 
> [ Upstream commit 4da3768e1820cf15cced390242d8789aed34f54d ]
> 
> When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn
> instruction, discard the exception and retry the instruction if the code
> stream is changed (e.g. by a different vCPU) between when the CPU
> executes the instruction and when KVM decodes the instruction to get the
> next RIP.
> 
> As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject
> INT3/INTO instead of retrying the instruction"), failure to verify that
> the correct INTn instruction was decoded can effectively clobber guest
> state due to decoding the wrong instruction and thus specifying the
> wrong next RIP.
> 
> The bug most often manifests as "Oops: int3" panics on static branch
> checks in Linux guests.  Enabling or disabling a static branch in Linux
> uses the kernel's "text poke" code patching mechanism.  To modify code
> while other CPUs may be executing that code, Linux (temporarily)
> replaces the first byte of the original instruction with an int3 (opcode
> 0xcc), then patches in the new code stream except for the first byte,
> and finally replaces the int3 with the first byte of the new code
> stream.  If a CPU hits the int3, i.e. executes the code while it's being
> modified, then the guest kernel must look up the RIP to determine how to
> handle the #BP, e.g. by emulating the new instruction.  If the RIP is
> incorrect, then this lookup fails and the guest kernel panics.
> 
> The bug reproduces almost instantly by hacking the guest kernel to
> repeatedly check a static branch[1] while running a drgn script[2] on
> the host to constantly swap out the memory containing the guest's TSS.
> 
> [1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a
> [2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b
> 
> Fixes: 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction")
> Cc: stable@vger.kernel.org
> Co-developed-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Omar Sandoval <osandov@fb.com>
> Link: https://patch.msgid.link/1cc6dcdf36e3add7ee7c8d90ad58414eeb6c3d34.1762278762.git.osandov@fb.com
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---

Acked-by: Sean Christopherson <seanjc@google.com>