Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752500AbdLLMQO (ORCPT ); Tue, 12 Dec 2017 07:16:14 -0500 Received: from mx1.redhat.com ([209.132.183.28]:59534 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751234AbdLLMQL (ORCPT ); Tue, 12 Dec 2017 07:16:11 -0500 Subject: Re: [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA To: Lan Tianyu Cc: rkrcmar@redhat.com, tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com, x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, dvyukov@google.com, jmattson@google.com, Wanpeng Li References: <1513034626-25688-1-git-send-email-tianyu.lan@intel.com> From: Paolo Bonzini Message-ID: <52cc38f0-17df-99ee-ae28-4b9cdb0d6794@redhat.com> Date: Tue, 12 Dec 2017 13:16:06 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <1513034626-25688-1-git-send-email-tianyu.lan@intel.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Tue, 12 Dec 2017 12:16:11 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3604 Lines: 79 On 12/12/2017 00:23, Lan Tianyu wrote: > > Reported by syzkaller: > WARNING: CPU: 0 PID: 27962 at arch/x86/kvm/emulate.c:5631 x86_emulate_insn+0x557/0x15f0 [kvm] > Modules linked in: kvm_intel kvm [last unloaded: kvm] > CPU: 0 PID: 27962 Comm: syz-executor Tainted: G B W 4.15.0-rc2-next-20171208+ #32 > Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.01.03.0006.040720161253 04/07/2016 > RIP: 0010:x86_emulate_insn+0x557/0x15f0 [kvm] > RSP: 0018:ffff8807234476d0 EFLAGS: 00010282 > RAX: 0000000000000000 RBX: ffff88072d0237a0 RCX: ffffffffa0065c4d > RDX: 1ffff100e5a046f9 RSI: 0000000000000003 RDI: ffff88072d0237c8 > RBP: ffff880723447728 R08: ffff88072d020000 R09: ffffffffa008d240 > R10: 0000000000000002 R11: ffffed00e7d87db3 R12: ffff88072d0237c8 > R13: ffff88072d023870 R14: ffff88072d0238c2 R15: ffffffffa008d080 > FS: 00007f8a68666700(0000) GS:ffff880802200000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 000000002009506c CR3: 000000071fec4005 CR4: 00000000003626f0 > Call Trace: > x86_emulate_instruction+0x3bc/0xb70 [kvm] > ? reexecute_instruction.part.162+0x130/0x130 [kvm] > vmx_handle_exit+0x46d/0x14f0 [kvm_intel] > ? trace_event_raw_event_kvm_entry+0xe7/0x150 [kvm] > ? handle_vmfunc+0x2f0/0x2f0 [kvm_intel] > ? wait_lapic_expire+0x25/0x270 [kvm] > vcpu_enter_guest+0x720/0x1ef0 [kvm] > ... > > Syzkaller tests KVM emulation code path with setting RSP 0xffffffffffffffff > and running in 64bit non paging mode. It triggers warning that exception > vector is > 1f(it's initialized to be 0xff in x86_emulate_instruction()) > during emulation of pop instruction. This is due to pop emulation callback > em_pop() returns X86EMUL_PROPAGATE_FAULT while not populate exception > vector. POP emulation code accesses RSP with linear address > 0xffffffffffffffff and KVM mmu returns GVA as GPA during nonpaging mode. > In this case, GPA 0xffffffffffffffff(~0) conflicts with error code > UNMAPPED_GVA which is defined to be (~(u64)0). Caller vcpu_mmio_gva_to > _gpa() treats the return address as error and this also causes emulator > _read_write_onepage() returns X86EMUL_PROPAGATE_FAULT without a validated > exception vector. > > This patch is to mask linear address with address width to fix such issue > since linear address won't occupy all 64-bit even if in 5 level paging > mode. This makes no sense, it will break access to the top half of the address space. The root cause of the issue is that 64-bit non-paging mode doesn't exist. KVM_SET_SREGS is not validating the input correctly; it should have failed. Paolo > Reported-by: Dmitry Vyukov > Cc: Paolo Bonzini > Cc: Radim Krčmář > Cc: Dmitry Vyukov > Cc: Jim Mattson > Cc: Wanpeng Li > Signed-off-by: Lan Tianyu > --- > arch/x86/kvm/emulate.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c > index abe74f7..9b21412 100644 > --- a/arch/x86/kvm/emulate.c > +++ b/arch/x86/kvm/emulate.c > @@ -697,8 +697,8 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt, > *max_size = 0; > switch (mode) { > case X86EMUL_MODE_PROT64: > - *linear = la; > va_bits = ctxt_virt_addr_bits(ctxt); > + *linear = la & ((1ul << va_bits) - 1); > if (get_canonical(la, va_bits) != la) > goto bad; > >