From: Sean Christopherson <seanjc@google.com>
To: Sasha Levin <sashal@kernel.org>
Cc: stable@vger.kernel.org, Bill Wendling <morbo@google.com>,
Stefan Teodorescu <fane@google.com>,
Paolo Bonzini <pbonzini@redhat.com>
Subject: Re: [PATCH 7.3.y 2/2] KVM: nSVM: Check validity of vmcs01 save area copied from SMRAM on RSM
Date: Thu, 12 Nov 2026 09:11:21 -0800 [thread overview]
Message-ID: <avXzOcWZAbejU2In@google.com> (raw)
In-Reply-To: <20261111170439.3395604-2-sashal@kernel.org>
On Wed, Nov 11, 2026, Sasha Levin wrote:
> From: Sean Christopherson <seanjc@google.com>
>
> [ Upstream commit 053621535f014085c935879582dd3b65964a0dce ]
>
> When doing RSM to L2, validate L1's state after copying it back into vmcb01
> from SMRAM, as SMRAM is carved out of guest memory, i.e. is writable by the
> guest. Failure to validate L1's state is especially problematic for inputs
> to MMU context, as KVM can end up with impossible CR4 vs. EFER state. E.g.
> without the recent hardening FNAME(walk_addr_generic), a guest can trigger:
>
> ------------[ cut here ]------------
> UBSAN: array-index-out-of-bounds in arch/x86/kvm/mmu/paging_tmpl.h:435:15
> index 3 is out of range for type 'u32 [2]'
> CPU: 3 UID: 0 PID: 92 Comm: CPU 1/KVM Not tainted 7.3.0-rc1 #2 PREEMPT(lazy)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0x5f/0x90
> dump_stack+0x10/0x18
> ubsan_epilogue+0x9/0x39
> __ubsan_handle_out_of_bounds.cold+0x50/0x55
> paging32_walk_addr_generic+0x889/0x970
> paging32_page_fault+0x79/0xa60
> kvm_mmu_do_page_fault+0x125/0x270
> kvm_mmu_page_fault+0x88/0x7b0
> npf_interception+0xc8/0x220 [kvm_amd]
> svm_invoke_exit_handler+0x16d/0x1d0 [kvm_amd]
> svm_handle_exit+0xb7/0x160 [kvm_amd]
> vcpu_enter_guest+0x428/0x16a0
> kvm_arch_vcpu_ioctl_run+0x479/0x920
> kvm_vcpu_ioctl+0x316/0xb00
> __x64_sys_ioctl+0xa3/0x100
> x64_sys_call+0x281/0x23d0
> do_syscall_64+0xba/0x550
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
> RIP: 0033:0x79bb30deb04b
> </TASK>
> ---[ end trace ]---
>
> Fixes: 37be407b2ce8 ("KVM: nSVM: Fix L1 state corruption upon return from SMM")
> Cc: stable@vger.kernel.org
> Reported-by: Bill Wendling <morbo@google.com>
> Reported-by: Stefan Teodorescu <fane@google.com>
> Tested-by: Stefan Teodorescu <fane@google.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Message-ID: <20261022021046.295001-1-seanjc@google.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
Acked-by: Sean Christopherson <seanjc@google.com>
next prev parent reply other threads:[~2026-11-12 17:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-10 1:01 FAILED: patch "[PATCH] KVM: nSVM: Check validity of vmcs01 save area copied from SMRAM on RSM" failed to apply to 7.3-stable tree Sasha Levin
2026-11-11 17:04 ` [PATCH 7.3.y 1/2] KVM: SVM: Add a vCPU-aware helper to get supported DEBUGCTL bits Sasha Levin
2026-11-11 17:04 ` [PATCH 7.3.y 2/2] KVM: nSVM: Check validity of vmcs01 save area copied from SMRAM on RSM Sasha Levin
2026-11-12 17:11 ` Sean Christopherson [this message]
2026-11-12 17:11 ` [PATCH 7.3.y 1/2] KVM: SVM: Add a vCPU-aware helper to get supported DEBUGCTL bits Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avXzOcWZAbejU2In@google.com \
--to=seanjc@google.com \
--cc=fane@google.com \
--cc=morbo@google.com \
--cc=pbonzini@redhat.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox