• W
    KVM: X86: Fix SMRAM accessing even if VM is shutdown · 95e057e2
    Wanpeng Li 提交于
    Reported by syzkaller:
    
       WARNING: CPU: 6 PID: 2434 at arch/x86/kvm/vmx.c:6660 handle_ept_misconfig+0x54/0x1e0 [kvm_intel]
       CPU: 6 PID: 2434 Comm: repro_test Not tainted 4.15.0+ #4
       RIP: 0010:handle_ept_misconfig+0x54/0x1e0 [kvm_intel]
       Call Trace:
        vmx_handle_exit+0xbd/0xe20 [kvm_intel]
        kvm_arch_vcpu_ioctl_run+0xdaf/0x1d50 [kvm]
        kvm_vcpu_ioctl+0x3e9/0x720 [kvm]
        do_vfs_ioctl+0xa4/0x6a0
        SyS_ioctl+0x79/0x90
        entry_SYSCALL_64_fastpath+0x25/0x9c
    
    The testcase creates a first thread to issue KVM_SMI ioctl, and then creates
    a second thread to mmap and operate on the same vCPU.  This triggers a race
    condition when running the testcase with multiple threads. Sometimes one thread
    exits with a triple fault while another thread mmaps and operates on the same
    vCPU.  Because CS=0x3000/IP=0x8000 is not mapped, accessing the SMI handler
    results in an EPT misconfig. This patch fixes it by returning RET_PF_EMULATE
    in kvm_handle_bad_page(), which will go on to cause an emulation failure and an
    exit with KVM_EXIT_INTERNAL_ERROR.
    
    Reported-by: syzbot+c1d9517cab094dae65e446c0c5b4de6c40f4dc58@syzkaller.appspotmail.com
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Radim Krčmář <rkrcmar@redhat.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: NWanpeng Li <wanpengli@tencent.com>
    Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
    95e057e2
mmu.c 141.9 KB