From patchwork Fri Dec 8 08:28:30 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tianyu Lan X-Patchwork-Id: 10101757 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A488B60325 for ; Fri, 8 Dec 2017 08:28:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 92F3328B2F for ; Fri, 8 Dec 2017 08:28:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 871CB28B35; Fri, 8 Dec 2017 08:28:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4C30A28B2F for ; Fri, 8 Dec 2017 08:28:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752736AbdLHI2c (ORCPT ); Fri, 8 Dec 2017 03:28:32 -0500 Received: from mail-ot0-f195.google.com ([74.125.82.195]:40610 "EHLO mail-ot0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752010AbdLHI2b (ORCPT ); Fri, 8 Dec 2017 03:28:31 -0500 Received: by mail-ot0-f195.google.com with SMTP id e74so8622450ote.7; Fri, 08 Dec 2017 00:28:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=YiposvEG3EwgNgBZS92VcAn2+j66XSevZqwQhN16By4=; b=iMuYyK2MIMS6VLuh6W04yja223IzxrtE/LMUyCaSCbICDdrdMYPacuvJqFmFaD09sU VD5qnhWgL73rs7A1JBDxu3E7yS70VgAZzT3mbD8rmnSEoW3+Sebl1rcoeDBmRsg73U0T Ys2vg1SEpwzRl1U7gBkJeVK17QySJSnZIXOsNc45490ZAzCJb5PSChsY4sG2I370feV0 sStmZp8MyD0zoXtc3SBHk5RMqlHtTPhdLnbfFLMuztB0Apx+pyhbpsX18WYtanIx7f9U 8k7C9/oHEJDs3jH4el3wSt9DWUJvfaSkTy5TMJZoX7h4wk69xJWKYilFR3trovvP7vxd 0fyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=YiposvEG3EwgNgBZS92VcAn2+j66XSevZqwQhN16By4=; b=jUOSdPVQRFenQlJ8Iu2ZQQPt9RPIy00j4zTyZnmg0QtNV33b7rOcdLBfcy8P1HrEO5 184J4NSCf3nrSdelpMJkPQMm8KIyn2Q3+l6yUxMHa8CCPEnLFU7VabXP7Gla/pFqslsm RTNz66ey0auoeZbUkzpLveEoG1gVTOYvc3mGJzv5IXT5xUsmpP7+tQfzDjrp5rdL0zSM wN+Q1Zv95zp9m4ZAHJ5qHvkWGxEpFEPOIS9pZL7Ia2x2BmHS9YFBFNRfJJbNvUlHhU/P MHofdp28UeskSo2I5xR9ncoUK/roJ1khMCEPsDSoosWC1Qb61dt8+e7z5legNlqQIUss XJeQ== X-Gm-Message-State: AJaThX6ywuozgVsshyp7SfBsfaVue1s0d2fyzYm5dmUEO86ZYKonnnpb WxSC8tH7F4iFrfa5m3mXkRf7rdVrbdap2/TQsjs= X-Google-Smtp-Source: AGs4zMaDiKvAOhl0M95aZwxxwkwwYurR0Ujs8AJ5dv9i39TTRoD2QmNIsKSwmREfPAVMei//AGKiMrwTTmRvchVwH88= X-Received: by 10.157.11.243 with SMTP id 106mr27288938oth.321.1512721710811; Fri, 08 Dec 2017 00:28:30 -0800 (PST) MIME-Version: 1.0 Received: by 10.157.55.162 with HTTP; Fri, 8 Dec 2017 00:28:30 -0800 (PST) In-Reply-To: References: <001a1143d526c5b1aa055f9d604c@google.com> From: Tianyu Lan Date: Fri, 8 Dec 2017 16:28:30 +0800 Message-ID: Subject: Re: WARNING in x86_emulate_insn To: Jim Mattson Cc: Wanpeng Li , Dmitry Vyukov , syzbot , "H. Peter Anvin" , kvm , "linux-kernel@vger.kernel.org" , Ingo Molnar , Paolo Bonzini , Radim Krcmar , syzkaller-bugs@googlegroups.com, Thomas Gleixner , "the arch/x86 maintainers" Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hi Jim&Wanpeng: Thanks for your help. 2017-12-08 5:25 GMT+08:00 Jim Mattson : > Try disabling the module parameter, "unrestricted_guest." Make sure > that the module parameter, "emulate_invalid_guest_state" is enabled. > This combination allows userspace to feed invalid guest state into the > in-kernel emulator. Yes, you are right. I need to disable unrestricted_guest to reproduce the issue. I find this is pop instruction emulation issue. According "SDM VOL2, chapter INSTRUCTION SET REFERENCE. POP—Pop a Value from the Stack" Protected Mode Exceptions #GP(0) If attempt is made to load SS register with NULL segment selector. This test case hits it but current code doesn't check such case. The following patch can fix the issue. diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index abe74f7..e2ac5cc 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1844,6 +1844,9 @@ static int emulate_pop(struct x86_emulate_ctxt *ctxt, int rc; struct segmented_address addr; + if ( !get_segment_selector(ctxt, VCPU_SREG_SS)) + return emulate_gp(ctxt, 0); + addr.ea = reg_read(ctxt, VCPU_REGS_RSP) & stack_mask(ctxt); addr.seg = VCPU_SREG_SS; rc = segmented_read(ctxt, addr, dest, len);