From patchwork Wed Feb 7 06:25:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Wanpeng Li X-Patchwork-Id: 10204649 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CDBA560247 for ; Wed, 7 Feb 2018 06:26:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9FACE28D86 for ; Wed, 7 Feb 2018 06:26:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 93E2D28DD2; Wed, 7 Feb 2018 06:26:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2365D28D86 for ; Wed, 7 Feb 2018 06:26:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750810AbeBGGZt (ORCPT ); Wed, 7 Feb 2018 01:25:49 -0500 Received: from mail-io0-f193.google.com ([209.85.223.193]:41665 "EHLO mail-io0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750767AbeBGGZs (ORCPT ); Wed, 7 Feb 2018 01:25:48 -0500 Received: by mail-io0-f193.google.com with SMTP id f4so797541ioh.8; Tue, 06 Feb 2018 22:25:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=INss/GVgiJfCJqsn3+vQ3B2U6Ul1ScEhf9EMB1poXoY=; b=aAY9/efhn0ksEpc8fM19fV3h9866KHxaIy70pHSvt/co9leyVYyowYv2+i/3CLwNYs p3e0Yipqe94DfZtG1E6MumpmL3SH8UxZCPSlkdwsQhJEUl/GlvN8pEFwsNcF8QKpwQJg 80FL4qra0biZArtRvsrVR7mabff7SxvztGRLDkNwMkUab7tYg6hQeAn5rQjDaelKRG8d UfdBr7gs51ljgP9CB6FUzDxejz+71X4xjF+KtbEGl1Y0Jisz1efn9wdpT50h0fYW+292 JMP62RGL/Lt6vQbkAWs8+alz/oqfslUEFZPqiPPSEIdKQWKwn4RZL2G3zbGzMUOFELy8 SQug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=INss/GVgiJfCJqsn3+vQ3B2U6Ul1ScEhf9EMB1poXoY=; b=jHufBptmoYE3gUTA1XSL2fwBlFg4KBylqbEXaj8eBCHOQIiW3ytXknG0It+TYFgMUt KfJUQ8cToeBzOSAR27oRt0WHtKryzWnBC6gHdd3ek1sVBZxcefKmgngnY3WckI3osSvt +wgMPBY41MsUtU/tThCGBgCITqjar8XwwUtRwjUdtd24/WglKCNTqx9nGzRMXEO9ryzo CBMw9N0oEqXt8S2SGSUyNOyCtgZumiv/2sgkwieJNCSXSZg7ak39s83QJ0QYAb+19+JH 3A5/v7TLuvCoGcM5aP2gVndXV8SQu9XGipysGOD7Ovzk/SUSB9HbWsWQ4M0AqyZz9Rzk AkTA== X-Gm-Message-State: APf1xPCTQJAzhkmI0326ctOXAyOYpECFHmAViV7A3HhON86I7pupEdyl UsTpABqRo4einY9mdumy7aR6mw== X-Google-Smtp-Source: AH8x225M9F/fcPSutMZRjNuc9sHjYFsgVVLAVGvvbBQukw/QDG9rlHkGA8vO4xQgUUv2LSa+Fl4YhA== X-Received: by 10.107.79.25 with SMTP id d25mr5853109iob.270.1517984747897; Tue, 06 Feb 2018 22:25:47 -0800 (PST) Received: from localhost.localdomain ([203.205.141.123]) by smtp.googlemail.com with ESMTPSA id r13sm680893ioa.4.2018.02.06.22.25.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 06 Feb 2018 22:25:47 -0800 (PST) From: Wanpeng Li X-Google-Original-From: Wanpeng Li To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Dmitry Vyukov Subject: [PATCH] KVM: X86: Fix SMRAM accessing even if VM is shutdown Date: Tue, 6 Feb 2018 22:25:06 -0800 Message-Id: <1517984706-47244-1-git-send-email-wanpengli@tencent.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Wanpeng Li Reported by syzkaller: WARNING: CPU: 6 PID: 2434 at arch/x86/kvm/vmx.c:6660 handle_ept_misconfig+0x54/0x1e0 [kvm_intel] CPU: 6 PID: 2434 Comm: repro_test Not tainted 4.15.0+ #4 RIP: 0010:handle_ept_misconfig+0x54/0x1e0 [kvm_intel] Call Trace: vmx_handle_exit+0xbd/0xe20 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xdaf/0x1d50 [kvm] kvm_vcpu_ioctl+0x3e9/0x720 [kvm] do_vfs_ioctl+0xa4/0x6a0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x25/0x9c The syzkaller creates a former thread to issue KVM_SMI ioctl, and then creates a latter thread to mmap and operate on the same vCPU, rsm emulation will not be executed since there is no something like seabios which implements smi handler when running syzkaller directly. This triggers a race condition when running the testcase with multiple threads. Sometimes one thread exit w/ SHUTDOWN reason, another thread mmaps and operates on the same vCPU, it continues to use CS=0x30000, IP=0x8000 to access the address of SMI handler which results in the above ept misconfig. This patch fixes it by bailing out immediately if the vCPU is marked EXIT_SHUTDOWN reason. Reported-by: Dmitry Vyukov Cc: Dmitry Vyukov Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Reported-by: syzbot+c1d9517cab094dae65e446c0c5b4de6c40f4dc58@syzkaller.appspotmail.com --- arch/x86/kvm/x86.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 786cd00..445e702 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -7458,6 +7458,11 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) goto out; } + if (unlikely(vcpu->run->exit_reason == KVM_EXIT_SHUTDOWN)) { + r = -EINVAL; + goto out; + } + if (vcpu->run->kvm_dirty_regs) { r = sync_regs(vcpu); if (r != 0)