korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-20 18:54:09 +08:00
Code Issues Packages Projects Releases Wiki Activity
712df65ccb
linux/arch/x86/kvm
History
Paolo Bonzini 58c95070da KVM: x86: fix off-by-one in reserved bits check 
29ecd66019 ("KVM: x86: avoid uninitialized variable warning",
2015-09-06) introduced a not-so-subtle problem, which probably
escaped review because it was not part of the patch context.

Before the patch, leaf was always equal to iterator.level.  After,
it is equal to iterator.level - 1 in the call to is_shadow_zero_bits_set,
and when is_shadow_zero_bits_set does another "-1" the check on
reserved bits becomes incorrect.  Using "iterator.level" in the call
fixes this call trace:

WARNING: CPU: 2 PID: 17000 at arch/x86/kvm/mmu.c:3385 handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]()
Modules linked in: tun sha256_ssse3 sha256_generic drbg binfmt_misc ipv6 vfat fat fuse dm_crypt dm_mod kvm_amd kvm crc32_pclmul aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd fam15h_power amd64_edac_mod k10temp edac_core amdkfd amd_iommu_v2 radeon acpi_cpufreq
[...]
Call Trace:
  dump_stack+0x4e/0x84
  warn_slowpath_common+0x95/0xe0
  warn_slowpath_null+0x1a/0x20
  handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]
  tdp_page_fault+0x231/0x290 [kvm]
  ? emulator_pio_in_out+0x6e/0xf0 [kvm]
  kvm_mmu_page_fault+0x36/0x240 [kvm]
  ? svm_set_cr0+0x95/0xc0 [kvm_amd]
  pf_interception+0xde/0x1d0 [kvm_amd]
  handle_exit+0x181/0xa70 [kvm_amd]
  ? kvm_arch_vcpu_ioctl_run+0x68b/0x1730 [kvm]
  kvm_arch_vcpu_ioctl_run+0x6f6/0x1730 [kvm]
  ? kvm_arch_vcpu_ioctl_run+0x68b/0x1730 [kvm]
  ? preempt_count_sub+0x9b/0xf0
  ? mutex_lock_killable_nested+0x26f/0x490
  ? preempt_count_sub+0x9b/0xf0
  kvm_vcpu_ioctl+0x358/0x710 [kvm]
  ? __fget+0x5/0x210
  ? __fget+0x101/0x210
  do_vfs_ioctl+0x2f4/0x560
  ? __fget_light+0x29/0x90
  SyS_ioctl+0x4c/0x90
  entry_SYSCALL_64_fastpath+0x16/0x73
---[ end trace 37901c8686d84de6 ]---

Reported-by: Borislav Petkov <bp@alien8.de>
Tested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-09-25 10:31:29 +02:00
..
assigned-dev.c VFS: assorted d_backing_inode() annotations 2015-04-15 15:06:59 -04:00
assigned-dev.h KVM: x86: move device assignment out of kvm_host.h 2014-11-24 16:53:50 +01:00
cpuid.c KVM: VMX: fix vmwrite to invalid VMCS 2015-07-10 13:25:25 +02:00
cpuid.h KVM: x86: save/load state on SMM switch 2015-06-04 16:17:46 +02:00
emulate.c Silence compiler warning in arch/x86/kvm/emulate.c 2015-09-06 16:26:23 +02:00
hyperv.c kvm/x86: added hyper-v crash msrs into kvm hyperv context 2015-07-23 08:27:06 +02:00
hyperv.h kvm/x86: added hyper-v crash msrs into kvm hyperv context 2015-07-23 08:27:06 +02:00
i8254.c KVM: x86: make vapics_in_nmi_mode atomic 2015-07-03 18:55:17 +02:00
i8254.h KVM: move iodev.h from virt/kvm/ to include/kvm 2015-03-26 21:43:12 +00:00
i8259.c KVM: x86: clean/fix memory barriers in irqchip_in_kernel 2015-07-30 16:02:56 +02:00
ioapic.c KVM: x86: drop unneeded null test 2015-05-07 11:29:47 +02:00
ioapic.h KVM/ARM changes for v4.1: 2015-04-07 18:09:20 +02:00
iommu.c KVM: count number of assigned devices 2015-07-10 13:25:26 +02:00
irq_comm.c kvm: x86: Deliver MSI IRQ to only lowest prio cpu if msi_redir_hint is true 2015-05-07 11:29:45 +02:00
irq.c KVM: nVMX: fix "acknowledge interrupt on exit" when APICv is in use 2014-08-05 15:00:24 +02:00
irq.h KVM: x86: clean/fix memory barriers in irqchip_in_kernel 2015-07-30 16:02:56 +02:00
Kconfig KVM: x86: mark legacy PCI device assignment as deprecated 2015-06-05 17:26:39 +02:00
kvm_cache_regs.h KVM: x86: API changes for SMM support 2015-06-04 16:01:11 +02:00
lapic.c Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2015-09-01 08:40:25 -07:00
lapic.h kvm/x86: move Hyper-V MSR's/hypercall code into hyperv.c file 2015-07-23 08:27:06 +02:00
Makefile kvm/x86: move Hyper-V MSR's/hypercall code into hyperv.c file 2015-07-23 08:27:06 +02:00
mmu_audit.c Minor merge needed, due to function move. 2015-07-01 10:49:25 -07:00
mmu.c KVM: x86: fix off-by-one in reserved bits check 2015-09-25 10:31:29 +02:00
mmu.h KVM: VMX: drop ept misconfig check 2015-08-05 12:47:26 +02:00
mmutrace.h tracing: Rename ftrace_event.h to trace_events.h 2015-05-13 14:05:12 -04:00
mtrr.c KVM: MTRR: Use default type for non-MTRR-covered gfn before WARN_ON 2015-08-05 12:47:21 +02:00
paging_tmpl.h KVM: MMU: move FNAME(is_rsvd_bits_set) to mmu.c 2015-08-05 12:47:22 +02:00
pmu_amd.c KVM: x86/vPMU: Fix unnecessary signed extension for AMD PERFCTRn 2015-08-11 15:19:41 +02:00
pmu_intel.c KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch 2015-06-23 14:12:14 +02:00
pmu.c KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch 2015-06-23 14:12:14 +02:00
pmu.h KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch 2015-06-23 14:12:14 +02:00
svm.c KVM: svm: do not call kvm_set_cr0 from init_vmcb 2015-09-25 10:31:22 +02:00
trace.h KVM: x86: save/load state on SMM switch 2015-06-04 16:17:46 +02:00
tss.h KVM: x86: hardware task switching support 2008-04-27 12:00:39 +03:00
vmx.c KVM: vmx: fix VPID is 0000H in non-root operation 2015-09-16 15:17:27 +02:00
x86.c KVM: x86: trap AMD MSRs for the TSeg base and mask 2015-09-21 07:41:22 +02:00
x86.h kvm/x86: move Hyper-V MSR's/hypercall code into hyperv.c file 2015-07-23 08:27:06 +02:00