Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <kk5mute6dt2.fsf@brer.local.valinux.co.jp> <CA+res+Qq1uw301md02ZDPNdiEtdFHOe5VKhsUZ_ugY_LK5t2mg@mail.gmail.com>
In-Reply-To: <CA+res+Qq1uw301md02ZDPNdiEtdFHOe5VKhsUZ_ugY_LK5t2mg@mail.gmail.com>
From:   Jinpu Wang <jinpu.wang@profitbricks.com>
Date:   Wed, 22 Aug 2018 10:32:35 +0200
Message-ID: <CAMGffEmyQhBQHrqa0wzdS7OSNeJHB+A-56RaX53NTAUCLjDLKg@mail.gmail.com>
Subject: Re: [PATCH] x86/kvm/vmx: Fix GPF on reading vmentry_l1d_flush
To:     minoura@valinux.co.jp, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org
Cc:     stable <stable@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

> From: MINOURA Makoto / =E7=AE=95=E6=B5=A6 =E7=9C=9F <minoura@valinux.co.j=
p>
> Date: 2018=E5=B9=B48=E6=9C=8822=E6=97=A5=E5=91=A8=E4=B8=89 =E4=B8=8A=E5=
=8D=889:50
> Subject: [PATCH] x86/kvm/vmx: Fix GPF on reading vmentry_l1d_flush
> To: <kvm@vger.kernel.org>
> Cc: <linux-kernel@vger.kernel.org>
>
>
>
> When EPT is not enabled, reading
> /sys/module/kvm_intel/parameters/vmentry_l1d_flush causes
> general protection fault in vmentry_l1d_flush_get() due to
> access beyond the end of the array vmentry_l1d_param[].
>
> Signed-off-by: Minoura Makoto <minoura@valinux.co.jp>
> ---
>  arch/x86/include/asm/vmx.h | 1 +
>  arch/x86/kvm/vmx.c         | 4 +++-
>  2 files changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
> index 95f9107449bf..c4b834b05178 100644
> --- a/arch/x86/include/asm/vmx.h
> +++ b/arch/x86/include/asm/vmx.h
> @@ -581,6 +581,7 @@ enum vmx_l1d_flush_state {
>         VMENTER_L1D_FLUSH_NEVER,
>         VMENTER_L1D_FLUSH_COND,
>         VMENTER_L1D_FLUSH_ALWAYS,
> +       VMENTER_L1D_FLUSH_PARAM_MAX =3D VMENTER_L1D_FLUSH_ALWAYS,
>         VMENTER_L1D_FLUSH_EPT_DISABLED,
>         VMENTER_L1D_FLUSH_NOT_REQUIRED,
>  };
> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
> index 1519f030fd73..155ba2a9139f 100644
> --- a/arch/x86/kvm/vmx.c
> +++ b/arch/x86/kvm/vmx.c
> @@ -204,6 +204,8 @@ static const struct {
>         {"never",       VMENTER_L1D_FLUSH_NEVER},
>         {"cond",        VMENTER_L1D_FLUSH_COND},
>         {"always",      VMENTER_L1D_FLUSH_ALWAYS},
> +       {"ept-disabled", VMENTER_L1D_FLUSH_EPT_DISABLED},
> +       {"not-required", VMENTER_L1D_FLUSH_NOT_REQUIRED},
>  };
>
>  #define L1D_CACHE_ORDER 4
> @@ -286,7 +288,7 @@ static int vmentry_l1d_flush_parse(const char *s)
>         unsigned int i;
>
>         if (s) {
> -               for (i =3D 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) {
> +               for (i =3D 0; i <=3D VMENTER_L1D_FLUSH_PARAM_MAX; i++) {
>                         if (sysfs_streq(s, vmentry_l1d_param[i].option))
>                                 return vmentry_l1d_param[i].cmd;
>                 }
Easy to reproduce. Thanks.
Tested-by: Jack Wang <jinpu.wang@profitbricks.com>

--
Jack Wang
Linux Kernel Developer

ProfitBricks GmbH
Greifswalder Str. 207
D - 10405 Berlin

Tel:       +49 30 577 008  042
Fax:      +49 30 577 008 299
Email:    jinpu.wang@profitbricks.com
URL:      https://www.profitbricks.de

Sitz der Gesellschaft: Berlin
Registergericht: Amtsgericht Charlottenburg, HRB 125506 B
Gesch=C3=A4ftsf=C3=BChrer: Achim Weiss, Matthias Steinberg, Christoph Steff=
ens