Received: by 2002:a25:d7c1:0:0:0:0:0 with SMTP id o184csp227820ybg; Thu, 17 Oct 2019 21:59:13 -0700 (PDT) X-Google-Smtp-Source: APXvYqzwZuqtaysvpjMfZ9VnS8SIXsPXUtbOxtp74cIk6Fz4iqQDvp0pfYs+I9LBqSwoVmVCxnxK X-Received: by 2002:a17:906:4716:: with SMTP id y22mr6912248ejq.225.1571374753383; Thu, 17 Oct 2019 21:59:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1571374753; cv=none; d=google.com; s=arc-20160816; b=YfcSfurx0rIsf7cp/c7DR1Th2QKwtSxCLkG026kWDZYukvGHXq7wzt/a5KPgooOnhP d0ZtU38l3BR/ICJ/WDoKk2cQ1p8Io5j5s8bzxfNKaKIVadqyw2B8TVBkdlaLcniPo1Ux NUy6GijA7sUUO4NNsBkTeTrMYGQIDHhgn++5RVOX0hs03PyaPmzSH8VqAksYCQW6ortX QUwOgvw9R8NYL46Gj1iriwMe96XS00SwUBjx6ehAQ+/+E6I5P5TilYGUsBIxcwCS8lIL tj9KNq7lCyJtFnC6+mZ0+Q5dlrqnRd6U/SR9s9zxOwbxrggAiG35pAihzOqxl1LrP1jV QiPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=CspLmT9IoylAdmwYQO/WTq2OwgUDhpV+LoLnXP25toI=; b=nQT6gR3DA1s3Izohc/jeCHboSb4O1rGc2u694mXUB+ATWLcJXzFsiI66pPkoHKtNck NCUQ+90cqMc0xbdZL9xbMghhqYVyKid8r7eZhqlNfSnHnBxbxp7b10KZYagF91RGDBWH u3PZo2EHdRl+b3JZ9MZ0AhE1Uwd0G7x+Fsc2vddCkkK5z1WULNEr/+iHClFb0oNpQDvT EujPNC5mPMxJCyiO9xTn4i2AkGfiQNuXUv1y1WQD2lZ6pNejwV2i3uei/KGCiG973cEJ j6btZ3oJ5+yOxBqIsLtOffwtdSZuix+bzQjEW+AdvlpyMP8WZFZlVxI7jGC1KsHp7FLd RKUg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=MWxXN6ny; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id t7si2703616ejo.302.2019.10.17.21.58.49; Thu, 17 Oct 2019 21:59:13 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=MWxXN6ny; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727114AbfJPWRC (ORCPT + 99 others); Wed, 16 Oct 2019 18:17:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:45204 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2395125AbfJPVy6 (ORCPT ); Wed, 16 Oct 2019 17:54:58 -0400 Received: from localhost (unknown [192.55.54.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0834321D7F; Wed, 16 Oct 2019 21:54:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1571262898; bh=UkZPZ2JHlM6NKJARZYfHgZ9GaZEYDT2KLd81t2jjAu0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MWxXN6nyG/I/jc/53LvwvieXT8pLVcWRd0oouUDONBQKqKe6VEpB4sVjdhEsJ1zTc MFhHbQPVKhPwQBHaLS+8dUydx+CryunAqzdoLy5Qnx7GJCGfJdhKI/+n1Wo+JJGhxc 3HYbpAFgQUMKX9eiey2lZreMdHBQD6Wa3fGn3XFw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jack Wang , Paolo Bonzini Subject: [PATCH 4.9 05/92] KVM: nVMX: handle page fault in vmread fix Date: Wed, 16 Oct 2019 14:49:38 -0700 Message-Id: <20191016214803.873050331@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191016214759.600329427@linuxfoundation.org> References: <20191016214759.600329427@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jack Wang During backport f7eea636c3d5 ("KVM: nVMX: handle page fault in vmread"), there was a mistake the exception reference should be passed to function kvm_write_guest_virt_system, instead of NULL, other wise, we will get NULL pointer deref, eg kvm-unit-test triggered a NULL pointer deref below: [ 948.518437] kvm [24114]: vcpu0, guest rIP: 0x407ef9 kvm_set_msr_common: MSR_IA32_DEBUGCTLMSR 0x3, nop [ 949.106464] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 949.106707] PGD 0 P4D 0 [ 949.106872] Oops: 0002 [#1] SMP [ 949.107038] CPU: 2 PID: 24126 Comm: qemu-2.7 Not tainted 4.19.77-pserver #4.19.77-1+feature+daily+update+20191005.1625+a4168bb~deb9 [ 949.107283] Hardware name: Dell Inc. Precision Tower 3620/09WH54, BIOS 2.7.3 01/31/2018 [ 949.107549] RIP: 0010:kvm_write_guest_virt_system+0x12/0x40 [kvm] [ 949.107719] Code: c0 5d 41 5c 41 5d 41 5e 83 f8 03 41 0f 94 c0 41 c1 e0 02 e9 b0 ed ff ff 0f 1f 44 00 00 48 89 f0 c6 87 59 56 00 00 01 48 89 d6 <49> c7 00 00 00 00 00 89 ca 49 c7 40 08 00 00 00 00 49 c7 40 10 00 [ 949.108044] RSP: 0018:ffffb31b0a953cb0 EFLAGS: 00010202 [ 949.108216] RAX: 000000000046b4d8 RBX: ffff9e9f415b0000 RCX: 0000000000000008 [ 949.108389] RDX: ffffb31b0a953cc0 RSI: ffffb31b0a953cc0 RDI: ffff9e9f415b0000 [ 949.108562] RBP: 00000000d2e14928 R08: 0000000000000000 R09: 0000000000000000 [ 949.108733] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffffffffc8 [ 949.108907] R13: 0000000000000002 R14: ffff9e9f4f26f2e8 R15: 0000000000000000 [ 949.109079] FS: 00007eff8694c700(0000) GS:ffff9e9f51a80000(0000) knlGS:0000000031415928 [ 949.109318] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 949.109495] CR2: 0000000000000000 CR3: 00000003be53b002 CR4: 00000000003626e0 [ 949.109671] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 949.109845] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 949.110017] Call Trace: [ 949.110186] handle_vmread+0x22b/0x2f0 [kvm_intel] [ 949.110356] ? vmexit_fill_RSB+0xc/0x30 [kvm_intel] [ 949.110549] kvm_arch_vcpu_ioctl_run+0xa98/0x1b30 [kvm] [ 949.110725] ? kvm_vcpu_ioctl+0x388/0x5d0 [kvm] [ 949.110901] kvm_vcpu_ioctl+0x388/0x5d0 [kvm] [ 949.111072] do_vfs_ioctl+0xa2/0x620 Signed-off-by: Jack Wang Acked-by: Paolo Bonzini --- arch/x86/kvm/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -7668,7 +7668,7 @@ static int handle_vmread(struct kvm_vcpu /* _system ok, as nested_vmx_check_permission verified cpl=0 */ if (kvm_write_guest_virt_system(vcpu, gva, &field_value, (is_long_mode(vcpu) ? 8 : 4), - NULL)) + &e)) kvm_inject_page_fault(vcpu, &e); }