linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>
Cc: "Wanpeng Li" <wanpeng.li@hotmail.com>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Radim Krčmář" <rkrcmar@redhat.com>,
	"Nadav Amit" <nadav.amit@gmail.com>,
	"Dmitry Vyukov" <dvyukov@google.com>,
	"Sasha Levin" <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL for 4.14 048/100] KVM: VMX: Fix rflags cache during vCPU reset
Date: Wed, 24 Jan 2018 04:14:48 +0000	[thread overview]
Message-ID: <20180124041414.32065-48-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20180124041414.32065-1-alexander.levin@microsoft.com>

From: Wanpeng Li <wanpeng.li@hotmail.com>

[ Upstream commit c37c28730bb031cc8a44a130c2555c0f3efbe2d0 ]

Reported by syzkaller:

   *** Guest State ***
   CR0: actual=0x0000000080010031, shadow=0x0000000060000010, gh_mask=fffffffffffffff7
   CR4: actual=0x0000000000002061, shadow=0x0000000000000000, gh_mask=ffffffffffffe8f1
   CR3 = 0x000000002081e000
   RSP = 0x000000000000fffa  RIP = 0x0000000000000000
   RFLAGS=0x00023000         DR7 = 0x00000000000000
          ^^^^^^^^^^
   ------------[ cut here ]------------
   WARNING: CPU: 6 PID: 24431 at /home/kernel/linux/arch/x86/kvm//x86.c:7302 kvm_arch_vcpu_ioctl_run+0x651/0x2ea0 [kvm]
   CPU: 6 PID: 24431 Comm: reprotest Tainted: G        W  OE   4.14.0+ #26
   RIP: 0010:kvm_arch_vcpu_ioctl_run+0x651/0x2ea0 [kvm]
   RSP: 0018:ffff880291d179e0 EFLAGS: 00010202
   Call Trace:
    kvm_vcpu_ioctl+0x479/0x880 [kvm]
    do_vfs_ioctl+0x142/0x9a0
    SyS_ioctl+0x74/0x80
    entry_SYSCALL_64_fastpath+0x23/0x9a

The failed vmentry is triggered by the following beautified testcase:

    #include <unistd.h>
    #include <sys/syscall.h>
    #include <string.h>
    #include <stdint.h>
    #include <linux/kvm.h>
    #include <fcntl.h>
    #include <sys/ioctl.h>

    long r[5];
    int main()
    {
        struct kvm_debugregs dr = { 0 };

        r[2] = open("/dev/kvm", O_RDONLY);
        r[3] = ioctl(r[2], KVM_CREATE_VM, 0);
        r[4] = ioctl(r[3], KVM_CREATE_VCPU, 7);
        struct kvm_guest_debug debug = {
                .control = 0xf0403,
                .arch = {
                        .debugreg[6] = 0x2,
                        .debugreg[7] = 0x2
                }
        };
        ioctl(r[4], KVM_SET_GUEST_DEBUG, &debug);
        ioctl(r[4], KVM_RUN, 0);
    }

which testcase tries to setup the processor specific debug
registers and configure vCPU for handling guest debug events through
KVM_SET_GUEST_DEBUG.  The KVM_SET_GUEST_DEBUG ioctl will get and set
rflags in order to set TF bit if single step is needed. All regs' caches
are reset to avail and GUEST_RFLAGS vmcs field is reset to 0x2 during vCPU
reset. However, the cache of rflags is not reset during vCPU reset. The
function vmx_get_rflags() returns an unreset rflags cache value since
the cache is marked avail, it is 0 after boot. Vmentry fails if the
rflags reserved bit 1 is 0.

This patch fixes it by resetting both the GUEST_RFLAGS vmcs field and
its cache to 0x2 during vCPU reset.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 arch/x86/kvm/vmx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index d073f91bc089..5242fac8165b 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5608,7 +5608,7 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
 		vmcs_write64(GUEST_IA32_DEBUGCTL, 0);
 	}
 
-	vmcs_writel(GUEST_RFLAGS, 0x02);
+	kvm_set_rflags(vcpu, X86_EFLAGS_FIXED);
 	kvm_rip_write(vcpu, 0xfff0);
 
 	vmcs_writel(GUEST_GDTR_BASE, 0);
-- 
2.11.0

  parent reply	other threads:[~2018-01-24  4:15 UTC|newest]

Thread overview: 105+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-24  4:14 [PATCH AUTOSEL for 4.14 001/100] drm/vc4: Account for interrupts in flight Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 002/100] btrfs: Fix transaction abort during failure in btrfs_rm_dev_item Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 003/100] Btrfs: bail out gracefully rather than BUG_ON Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 004/100] cpupowerutils: bench - Fix cpu online check Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 005/100] cpupower : Fix cpupower working when cpu0 is offline Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 006/100] KVM: nVMX/nSVM: Don't intercept #UD when running L2 Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 007/100] KVM: x86: emulator: Return to user-mode on L1 CPL=0 emulation failure Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 009/100] KVM: X86: Fix operand/address-size during instruction decoding Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 008/100] KVM: x86: Don't re-execute instruction when not passing CR2 value Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 010/100] KVM: nVMX: Fix mmu context after VMLAUNCH/VMRESUME failure Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 012/100] KVM: x86: ioapic: Fix level-triggered EOI and IOAPIC reconfigure race Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 011/100] KVM: x86: fix em_fxstor() sleeping while in atomic Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 014/100] KVM: x86: ioapic: Preserve read-only values in the redirection table Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 013/100] KVM: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 015/100] KVM: nVMX: Fix vmx_check_nested_events() return value in case an event was reinjected to L2 Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 016/100] KVM: x86: Fix CPUID function for word 6 (80000001_ECX) Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 017/100] nvme-fabrics: introduce init command check for a queue that is not alive Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 019/100] nvme-loop: check if queue is ready in queue_rq Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 018/100] nvme-fc: " Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 020/100] nvme-pci: disable APST on Samsung SSD 960 EVO + ASUS PRIME B350M-A Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 022/100] nvmet-fc: correct ref counting error when deferred rcv used Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 021/100] nvme-pci: avoid hmb desc array idx out-of-bound when hmmaxd set Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 024/100] s390/zcrypt: Fix wrong comparison leading to strange load balancing Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 023/100] s390/topology: fix compile error in file arch/s390/kernel/smp.c Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 025/100] ACPI / bus: Leave modalias empty for devices which are not present Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 027/100] null_blk: fix dev->badblocks leak Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 026/100] cpufreq: Add Loongson machine dependencies Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 029/100] rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 028/100] s390: fix alloc_pgste check in init_new_context again Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 031/100] rxrpc: Fix service endpoint expiry Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 030/100] rxrpc: Provide a different lockdep key for call->user_mutex for kernel calls Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 032/100] bcache: check return value of register_shrinker Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 033/100] drm/amdgpu: Fix SDMA load/unload sequence on HWS disabled mode Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 034/100] drm/amdkfd: Fix SDMA ring buffer size calculation Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 035/100] drm/amdkfd: Fix SDMA oversubsription handling Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 036/100] uapi: fix linux/kfd_ioctl.h userspace compilation errors Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 037/100] nvme-rdma: don't complete requests before a send work request has completed Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 038/100] openvswitch: fix the incorrect flow action alloc size Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 039/100] drm/rockchip: dw-mipi-dsi: fix possible un-balanced runtime PM enable Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 040/100] mac80211: use QoS NDP for AP probing Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 041/100] mac80211: fix the update of path metric for RANN frame Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 043/100] sctp: only allow the asoc reset when the asoc outq is empty Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 042/100] btrfs: fix deadlock when writing out space cache Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 044/100] sctp: avoid flushing unsent queue when doing asoc reset Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 045/100] sctp: set sender next_tsn for the old result with ctsn_ack_point plus 1 Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 047/100] KVM: X86: Fix softlockup when get the current kvmclock Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 046/100] reiserfs: remove unneeded i_version bump Sasha Levin
2018-01-24  4:14 ` Sasha Levin [this message]
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 050/100] KVM: Let KVM_SET_SIGNAL_MASK work as advertised Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 049/100] Btrfs: fix list_add corruption and soft lockups in fsync Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 051/100] xfs: always free inline data before resetting inode fork during ifree Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 052/100] xfs: log recovery should replay deferred ops in order Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 053/100] i2c: i2c-boardinfo: fix memory leaks on devinfo Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 054/100] xen-netfront: remove warning when unloading module Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 055/100] auxdisplay: img-ascii-lcd: Only build on archs that have IOMEM Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 057/100] nfsd: Ensure we don't recognise lock stateids after freeing them Sasha Levin
2018-01-24 15:47   ` J. Bruce Fields
2018-01-24 17:28     ` Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 056/100] nfsd: CLOSE SHOULD return the invalid special stateid for NFSv4.x (x>0) Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 058/100] nfsd: Ensure we check stateid validity in the seqid operation checks Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 059/100] grace: replace BUG_ON by WARN_ONCE in exit_net hook Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 061/100] race of lockd inetaddr notifiers vs nlmsvc_rqst change Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 060/100] nfsd: check for use of the closed special stateid Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 062/100] lockd: fix "list_add double add" caused by legacy signal interface Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 063/100] hwmon: (pmbus) Use 64bit math for DIRECT format values Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 064/100] quota: propagate error from __dquot_initialize Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 066/100] net: mvpp2: do not disable GMAC padding Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 065/100] net: mvpp2: fix the txq_init error path Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 067/100] net: phy: marvell10g: fix the PHY id mask Sasha Levin
2018-01-24  4:14 ` [PATCH AUTOSEL for 4.14 068/100] bnxt_en: Fix an error handling path in 'bnxt_get_module_eeprom()' Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 069/100] Btrfs: incremental send, fix wrong unlink path after renaming file Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 070/100] nvme-pci: fix NULL pointer dereference in nvme_free_host_mem() Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 072/100] drm/amdgpu: don't try to move pinned BOs Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 071/100] xfs: fortify xfs_alloc_buftarg error handling Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 073/100] net: ethernet: xilinx: Mark XILINX_LL_TEMAC broken on 64-bit Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 074/100] quota: Check for register_shrinker() failure Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 075/100] SUNRPC: Allow connect to return EHOSTUNREACH Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 077/100] fs/mbcache.c: make count_objects() more robust Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 076/100] scripts/faddr2line: extend usage on generic arch Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 078/100] kmemleak: add scheduling point to kmemleak_scan() Sasha Levin
2018-01-24  7:46   ` Yisheng Xie
2018-01-24 17:24     ` Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 079/100] drm/bridge: Fix lvds-encoder since the panel_bridge rework Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 080/100] drm/bridge: tc358767: do no fail on hi-res displays Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 082/100] drm/bridge: tc358767: fix DP0_MISC register set Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 081/100] drm/bridge: tc358767: filter out too high modes Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 084/100] drm/bridge: tc358767: fix AUXDATAn registers access Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 083/100] drm/bridge: tc358767: fix timing calculations Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 085/100] drm/bridge: tc358767: fix 1-lane behavior Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 086/100] drm/omap: Fix error handling path in 'omap_dmm_probe()' Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 087/100] drm/omap: displays: panel-dpi: add backlight dependency Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 088/100] xfs: ubsan fixes Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 089/100] xfs: Properly retry failed dquot items in case of error during buffer writeback Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 091/100] scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 090/100] perf/core: Fix memory leak triggered by perf --namespace Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 092/100] scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 093/100] iwlwifi: mvm: fix the TX queue hang timeout for MONITOR vif type Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 094/100] iwlwifi: fix access to prph when transport is stopped Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 096/100] ARM: dts: NSP: Fix PPI interrupt types Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 095/100] ARM: dts: NSP: Disable AHCI controller for HR NSP boards Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 097/100] media: usbtv: add a new usbid Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 098/100] x86/xen: Support early interrupts in xen pv guests Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 099/100] usb: gadget: don't dereference g until after it has been null checked Sasha Levin
2018-01-24  4:15 ` [PATCH AUTOSEL for 4.14 100/100] staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID Sasha Levin
2018-01-25  3:30 ` [PATCH AUTOSEL for 4.14 001/100] drm/vc4: Account for interrupts in flight Eric Anholt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180124041414.32065-48-alexander.levin@microsoft.com \
    --to=alexander.levin@microsoft.com \
    --cc=dvyukov@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nadav.amit@gmail.com \
    --cc=pbonzini@redhat.com \
    --cc=rkrcmar@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=wanpeng.li@hotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).