kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/arch/x86/kvm
History
Paolo Bonzini ded4fc623b KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS 
commit d14bdb553f upstream.

MOV to DR6 or DR7 causes a #GP if an attempt is made to write a 1 to
any of bits 63:32.  However, this is not detected at KVM_SET_DEBUGREGS
time, and the next KVM_RUN oopses:

   general protection fault: 0000 [#1] SMP
   CPU: 2 PID: 14987 Comm: a.out Not tainted 4.4.9-300.fc23.x86_64 #1
   Hardware name: LENOVO 2325F51/2325F51, BIOS G2ET32WW (1.12 ) 05/30/2012
   [...]
   Call Trace:
    [<ffffffffa072c93d>] kvm_arch_vcpu_ioctl_run+0x141d/0x14e0 [kvm]
    [<ffffffffa071405d>] kvm_vcpu_ioctl+0x33d/0x620 [kvm]
    [<ffffffff81241648>] do_vfs_ioctl+0x298/0x480
    [<ffffffff812418a9>] SyS_ioctl+0x79/0x90
    [<ffffffff817a0f2e>] entry_SYSCALL_64_fastpath+0x12/0x71
   Code: 55 83 ff 07 48 89 e5 77 27 89 ff ff 24 fd 90 87 80 81 0f 23 fe 5d c3 0f 23 c6 5d c3 0f 23 ce 5d c3 0f 23 d6 5d c3 0f 23 de 5d c3 <0f> 23 f6 5d c3 0f 0b 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00
   RIP  [<ffffffff810639eb>] native_set_debugreg+0x2b/0x40
    RSP <ffff88005836bd50>

Testcase (beautified/reduced from syzkaller output):

    #include <unistd.h>
    #include <sys/syscall.h>
    #include <string.h>
    #include <stdint.h>
    #include <linux/kvm.h>
    #include <fcntl.h>
    #include <sys/ioctl.h>

    long r[8];

    int main()
    {
        struct kvm_debugregs dr = { 0 };

        r[2] = open("/dev/kvm", O_RDONLY);
        r[3] = ioctl(r[2], KVM_CREATE_VM, 0);
        r[4] = ioctl(r[3], KVM_CREATE_VCPU, 7);

        memcpy(&dr,
               "\x5d\x6a\x6b\xe8\x57\x3b\x4b\x7e\xcf\x0d\xa1\x72"
               "\xa3\x4a\x29\x0c\xfc\x6d\x44\x00\xa7\x52\xc7\xd8"
               "\x00\xdb\x89\x9d\x78\xb5\x54\x6b\x6b\x13\x1c\xe9"
               "\x5e\xd3\x0e\x40\x6f\xb4\x66\xf7\x5b\xe3\x36\xcb",
               48);
        r[7] = ioctl(r[4], KVM_SET_DEBUGREGS, &dr);
        r[6] = ioctl(r[4], KVM_RUN, 0);
    }

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2016-06-24 10:18:18 -07:00
..
assigned-dev.c KVM: x86: move kvm_set_irq_inatomic to legacy device assignment 2015-11-04 16:24:36 +01:00
assigned-dev.h KVM: x86: move device assignment out of kvm_host.h 2014-11-24 16:53:50 +01:00
cpuid.c KVM: x86: mask CPUID(0xD,0x1).EAX against host value 2016-06-01 12:15:52 -07:00
cpuid.h KVM: MTRR: treat memory as writeback if MTRR is disabled in guest CPUID 2015-12-22 15:29:00 +01:00
emulate.c KVM: x86: fix conversion of addresses to linear in 32-bit protected mode 2016-03-03 15:07:29 -08:00
hyperv.c kvm/x86: Hyper-V HV_X64_MSR_VP_RUNTIME support 2015-10-01 15:06:33 +02:00
hyperv.h kvm/x86: added hyper-v crash msrs into kvm hyperv context 2015-07-23 08:27:06 +02:00
i8254.c KVM: i8254: change PIT discard tick policy 2016-04-12 09:08:33 -07:00
i8254.h KVM: move iodev.h from virt/kvm/ to include/kvm 2015-03-26 21:43:12 +00:00
i8259.c KVM: x86: clean/fix memory barriers in irqchip_in_kernel 2015-07-30 16:02:56 +02:00
ioapic.c KVM: x86: fix edge EOI and IOAPIC reconfig race 2015-10-14 16:41:08 +02:00
ioapic.h KVM: x86: Add EOI exit bitmap inference 2015-10-01 15:06:28 +02:00
iommu.c KVM: count number of assigned devices 2015-07-10 13:25:26 +02:00
irq.c KVM: x86: Add support for local interrupt requests from userspace 2015-10-01 15:06:29 +02:00
irq.h KVM: x86: Add support for local interrupt requests from userspace 2015-10-01 15:06:29 +02:00
irq_comm.c KVM: x86: move kvm_set_irq_inatomic to legacy device assignment 2015-11-04 16:24:36 +01:00
Kconfig KVM: x86: select IRQ_BYPASS_MANAGER 2015-10-01 15:06:52 +02:00
kvm_cache_regs.h KVM: x86: API changes for SMM support 2015-06-04 16:01:11 +02:00
lapic.c KVM: x86: Move TSC scaling logic out of call-back read_l1_tsc() 2015-11-10 12:06:18 +01:00
lapic.h KVM: Define a new interface kvm_intr_is_single_vcpu() 2015-10-01 15:06:49 +02:00
Makefile kvm/x86: move Hyper-V MSR's/hypercall code into hyperv.c file 2015-07-23 08:27:06 +02:00
mmu.c KVM: MMU: fix reserved bit check for ept=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 2016-03-16 08:42:58 -07:00
mmu.h KVM: x86: merge handle_mmio_page_fault and handle_mmio_page_fault_common 2015-11-10 12:06:03 +01:00
mmu_audit.c Minor merge needed, due to function move. 2015-07-01 10:49:25 -07:00
mmutrace.h tracing: Rename ftrace_event.h to trace_events.h 2015-05-13 14:05:12 -04:00
mtrr.c KVM: MTRR: remove MSR 0x2f8 2016-06-01 12:15:52 -07:00
paging_tmpl.h KVM: x86: MMU: fix ubsan index-out-of-range warning 2016-03-03 15:07:29 -08:00
pmu.c KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch 2015-06-23 14:12:14 +02:00
pmu.h KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch 2015-06-23 14:12:14 +02:00
pmu_amd.c KVM: x86/vPMU: Fix unnecessary signed extension for AMD PERFCTRn 2015-08-11 15:19:41 +02:00
pmu_intel.c KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch 2015-06-23 14:12:14 +02:00
svm.c kvm: x86: move tracepoints outside extended quiescent state 2015-12-11 12:26:33 +01:00
trace.h KVM: x86: correctly print #AC in traces 2016-01-31 11:28:54 -08:00
tss.h KVM: x86: hardware task switching support 2008-04-27 12:00:39 +03:00
vmx.c KVM: x86: fix ordering of cr0 initialization code in vmx_cpu_reset 2016-06-01 12:15:52 -07:00
x86.c KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS 2016-06-24 10:18:18 -07:00
x86.h x86/fpu: Rename XSAVE macros 2015-09-14 12:21:46 +02:00