Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751871AbdLLHBV (ORCPT ); Tue, 12 Dec 2017 02:01:21 -0500 Received: from mga07.intel.com ([134.134.136.100]:28819 "EHLO mga07.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750955AbdLLHBR (ORCPT ); Tue, 12 Dec 2017 02:01:17 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,394,1508828400"; d="scan'208";a="1840795" Subject: Re: Re: [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA To: Wanpeng Li References: <1513034626-25688-1-git-send-email-tianyu.lan@intel.com> Cc: Paolo Bonzini , Radim Krcmar , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , the arch/x86 maintainers , kvm , "linux-kernel@vger.kernel.org" , Dmitry Vyukov , Jim Mattson From: Lan Tianyu Message-ID: <57318e2e-be13-2b73-8d5e-54e9ab10aeba@intel.com> Date: Tue, 12 Dec 2017 14:51:17 +0800 User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2997 Lines: 61 On 2017年12月12日 14:42, Wanpeng Li wrote: > 2017-12-12 7:23 GMT+08:00 Lan Tianyu : >> >> Reported by syzkaller: >> WARNING: CPU: 0 PID: 27962 at arch/x86/kvm/emulate.c:5631 x86_emulate_insn+0x557/0x15f0 [kvm] >> Modules linked in: kvm_intel kvm [last unloaded: kvm] >> CPU: 0 PID: 27962 Comm: syz-executor Tainted: G B W 4.15.0-rc2-next-20171208+ #32 >> Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.01.03.0006.040720161253 04/07/2016 >> RIP: 0010:x86_emulate_insn+0x557/0x15f0 [kvm] >> RSP: 0018:ffff8807234476d0 EFLAGS: 00010282 >> RAX: 0000000000000000 RBX: ffff88072d0237a0 RCX: ffffffffa0065c4d >> RDX: 1ffff100e5a046f9 RSI: 0000000000000003 RDI: ffff88072d0237c8 >> RBP: ffff880723447728 R08: ffff88072d020000 R09: ffffffffa008d240 >> R10: 0000000000000002 R11: ffffed00e7d87db3 R12: ffff88072d0237c8 >> R13: ffff88072d023870 R14: ffff88072d0238c2 R15: ffffffffa008d080 >> FS: 00007f8a68666700(0000) GS:ffff880802200000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: 000000002009506c CR3: 000000071fec4005 CR4: 00000000003626f0 >> Call Trace: >> x86_emulate_instruction+0x3bc/0xb70 [kvm] >> ? reexecute_instruction.part.162+0x130/0x130 [kvm] >> vmx_handle_exit+0x46d/0x14f0 [kvm_intel] >> ? trace_event_raw_event_kvm_entry+0xe7/0x150 [kvm] >> ? handle_vmfunc+0x2f0/0x2f0 [kvm_intel] >> ? wait_lapic_expire+0x25/0x270 [kvm] >> vcpu_enter_guest+0x720/0x1ef0 [kvm] >> ... >> >> Syzkaller tests KVM emulation code path with setting RSP 0xffffffffffffffff >> and running in 64bit non paging mode. It triggers warning that exception >> vector is > 1f(it's initialized to be 0xff in x86_emulate_instruction()) >> during emulation of pop instruction. This is due to pop emulation callback >> em_pop() returns X86EMUL_PROPAGATE_FAULT while not populate exception >> vector. POP emulation code accesses RSP with linear address >> 0xffffffffffffffff and KVM mmu returns GVA as GPA during nonpaging mode. >> In this case, GPA 0xffffffffffffffff(~0) conflicts with error code >> UNMAPPED_GVA which is defined to be (~(u64)0). Caller vcpu_mmio_gva_to >> _gpa() treats the return address as error and this also causes emulator >> _read_write_onepage() returns X86EMUL_PROPAGATE_FAULT without a validated >> exception vector. >> >> This patch is to mask linear address with address width to fix such issue >> since linear address won't occupy all 64-bit even if in 5 level paging >> mode. >> >> Reported-by: Dmitry Vyukov >> Cc: Paolo Bonzini >> Cc: Radim Krčmář >> Cc: Dmitry Vyukov >> Cc: Jim Mattson >> Cc: Wanpeng Li >> Signed-off-by: Lan Tianyu > > Tested-by: Wanpeng Li > Thanks a lot. -- Best regards Tianyu Lan