summaryrefslogtreecommitdiffstats
path: root/tools/kvm
diff options
context:
space:
mode:
authorWanpeng Li <wanpengli@tencent.com>2018-02-08 08:32:45 +0100
committerPaolo Bonzini <pbonzini@redhat.com>2018-02-24 01:43:37 +0100
commit95e057e25892eaa48cad1e2d637b80d0f1a4fac5 (patch)
treedfb6859c7ba574e9a458bebfcafe6a5dc179ece7 /tools/kvm
parentKVM: nVMX: Don't halt vcpu when L1 is injecting events to L2 (diff)
downloadlinux-95e057e25892eaa48cad1e2d637b80d0f1a4fac5.tar.xz
linux-95e057e25892eaa48cad1e2d637b80d0f1a4fac5.zip
KVM: X86: Fix SMRAM accessing even if VM is shutdown
Reported by syzkaller: WARNING: CPU: 6 PID: 2434 at arch/x86/kvm/vmx.c:6660 handle_ept_misconfig+0x54/0x1e0 [kvm_intel] CPU: 6 PID: 2434 Comm: repro_test Not tainted 4.15.0+ #4 RIP: 0010:handle_ept_misconfig+0x54/0x1e0 [kvm_intel] Call Trace: vmx_handle_exit+0xbd/0xe20 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xdaf/0x1d50 [kvm] kvm_vcpu_ioctl+0x3e9/0x720 [kvm] do_vfs_ioctl+0xa4/0x6a0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x25/0x9c The testcase creates a first thread to issue KVM_SMI ioctl, and then creates a second thread to mmap and operate on the same vCPU. This triggers a race condition when running the testcase with multiple threads. Sometimes one thread exits with a triple fault while another thread mmaps and operates on the same vCPU. Because CS=0x3000/IP=0x8000 is not mapped, accessing the SMI handler results in an EPT misconfig. This patch fixes it by returning RET_PF_EMULATE in kvm_handle_bad_page(), which will go on to cause an emulation failure and an exit with KVM_EXIT_INTERNAL_ERROR. Reported-by: syzbot+c1d9517cab094dae65e446c0c5b4de6c40f4dc58@syzkaller.appspotmail.com Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Wanpeng Li <wanpengli@tencent.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'tools/kvm')
0 files changed, 0 insertions, 0 deletions