Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752892AbdLEGVy (ORCPT ); Tue, 5 Dec 2017 01:21:54 -0500 Received: from mail-pg0-f67.google.com ([74.125.83.67]:43460 "EHLO mail-pg0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752864AbdLEGVo (ORCPT ); Tue, 5 Dec 2017 01:21:44 -0500 X-Google-Smtp-Source: AGs4zMZ4Z1ijTqkBkTrMdUSVywlDfatAIFm5SU2UMDUlSPxa3zzYyCwxA1x0FTCWtZgEaYETxqSV4w== From: Wanpeng Li X-Google-Original-From: Wanpeng Li To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Wanpeng Li , Jim Mattson Subject: [PATCH 2/2] KVM: X86: Fix load RFLAGS w/o the fixed bit Date: Mon, 4 Dec 2017 22:21:31 -0800 Message-Id: <1512454891-7062-2-git-send-email-wanpeng.li@hotmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1512454891-7062-1-git-send-email-wanpeng.li@hotmail.com> References: <1512454891-7062-1-git-send-email-wanpeng.li@hotmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1908 Lines: 65 From: Wanpeng Li *** Guest State *** CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7 CR4: actual=0x0000000000002050, shadow=0x0000000000000000, gh_mask=ffffffffffffe871 CR3 = 0x00000000fffbc000 RSP = 0x0000000000000000 RIP = 0x0000000000000000 RFLAGS=0x00000000 DR7 = 0x0000000000000400 ^^^^^^^^^^ The failed vmentry is triggered by the following testcase when ept=Y: #include #include #include #include #include #include #include long r[5]; int main() { r[2] = open("/dev/kvm", O_RDONLY); r[3] = ioctl(r[2], KVM_CREATE_VM, 0); r[4] = ioctl(r[3], KVM_CREATE_VCPU, 7); struct kvm_regs regs = { .rflags = 0, }; ioctl(r[4], KVM_SET_REGS, ®s); ioctl(r[4], KVM_RUN, 0); } X86 RFLAGS bit 1 is fixed set, userspace can simply clearing bit 1 of RFLAGS with KVM_SET_REGS ioctl which results in vmentry fails. This patch fixes it by catching userspace set RFLAGS w/o the fixes bit and bailing out immediately. Suggested-by: Jim Mattson Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Jim Mattson Signed-off-by: Wanpeng Li --- virt/kvm/kvm_main.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index c01cff0..7100833 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -2602,6 +2602,11 @@ static long kvm_vcpu_ioctl(struct file *filp, r = PTR_ERR(kvm_regs); goto out; } + r = -EINVAL; + if (!(kvm_regs->rflags & X86_EFLAGS_FIXED)) { + kfree(kvm_regs); + goto out; + } r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs); kfree(kvm_regs); break; -- 2.7.4