From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752971AbdLHI2d (ORCPT ); Fri, 8 Dec 2017 03:28:33 -0500 Received: from mail-ot0-f195.google.com ([74.125.82.195]:40610 "EHLO mail-ot0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752010AbdLHI2b (ORCPT ); Fri, 8 Dec 2017 03:28:31 -0500 X-Google-Smtp-Source: AGs4zMaDiKvAOhl0M95aZwxxwkwwYurR0Ujs8AJ5dv9i39TTRoD2QmNIsKSwmREfPAVMei//AGKiMrwTTmRvchVwH88= MIME-Version: 1.0 In-Reply-To: References: <001a1143d526c5b1aa055f9d604c@google.com> From: Tianyu Lan Date: Fri, 8 Dec 2017 16:28:30 +0800 Message-ID: Subject: Re: WARNING in x86_emulate_insn To: Jim Mattson Cc: Wanpeng Li , Dmitry Vyukov , syzbot , "H. Peter Anvin" , kvm , "linux-kernel@vger.kernel.org" , Ingo Molnar , Paolo Bonzini , Radim Krcmar , syzkaller-bugs@googlegroups.com, Thomas Gleixner , "the arch/x86 maintainers" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id vB88SbFk026450 Hi Jim&Wanpeng: Thanks for your help. 2017-12-08 5:25 GMT+08:00 Jim Mattson : > Try disabling the module parameter, "unrestricted_guest." Make sure > that the module parameter, "emulate_invalid_guest_state" is enabled. > This combination allows userspace to feed invalid guest state into the > in-kernel emulator. Yes, you are right. I need to disable unrestricted_guest to reproduce the issue. I find this is pop instruction emulation issue. According "SDM VOL2, chapter INSTRUCTION SET REFERENCE. POP—Pop a Value from the Stack" Protected Mode Exceptions #GP(0) If attempt is made to load SS register with NULL segment selector. This test case hits it but current code doesn't check such case. The following patch can fix the issue. diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index abe74f7..e2ac5cc 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1844,6 +1844,9 @@ static int emulate_pop(struct x86_emulate_ctxt *ctxt, int rc; struct segmented_address addr; + if ( !get_segment_selector(ctxt, VCPU_SREG_SS)) + return emulate_gp(ctxt, 0); + addr.ea = reg_read(ctxt, VCPU_REGS_RSP) & stack_mask(ctxt); addr.seg = VCPU_SREG_SS; rc = segmented_read(ctxt, addr, dest, len);