From: Paolo Bonzini <pbonzini@redhat.com>
To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
Cc: Sean Christopherson <seanjc@google.com>,
stable@vger.kernel.org, Bill Wendling <morbo@google.com>,
Stefan Teodorescu <fane@google.com>
Subject: [PATCH 1/7] KVM: nSVM: Check validity of vmcs01 save area copied from SMRAM on RSM
Date: Mon, 2 Nov 2026 18:14:22 -0500 [thread overview]
Message-ID: <20261102231428.13523-2-pbonzini@redhat.com> (raw)
In-Reply-To: <20261102231428.13523-1-pbonzini@redhat.com>
From: Sean Christopherson <seanjc@google.com>
When doing RSM to L2, validate L1's state after copying it back into vmcb01
from SMRAM, as SMRAM is carved out of guest memory, i.e. is writable by the
guest. Failure to validate L1's state is especially problematic for inputs
to MMU context, as KVM can end up with impossible CR4 vs. EFER state. E.g.
without the recent hardening FNAME(walk_addr_generic), a guest can trigger:
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in arch/x86/kvm/mmu/paging_tmpl.h:435:15
index 3 is out of range for type 'u32 [2]'
CPU: 3 UID: 0 PID: 92 Comm: CPU 1/KVM Not tainted 7.3.0-rc1 #2 PREEMPT(lazy)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x5f/0x90
dump_stack+0x10/0x18
ubsan_epilogue+0x9/0x39
__ubsan_handle_out_of_bounds.cold+0x50/0x55
paging32_walk_addr_generic+0x889/0x970
paging32_page_fault+0x79/0xa60
kvm_mmu_do_page_fault+0x125/0x270
kvm_mmu_page_fault+0x88/0x7b0
npf_interception+0xc8/0x220 [kvm_amd]
svm_invoke_exit_handler+0x16d/0x1d0 [kvm_amd]
svm_handle_exit+0xb7/0x160 [kvm_amd]
vcpu_enter_guest+0x428/0x16a0
kvm_arch_vcpu_ioctl_run+0x479/0x920
kvm_vcpu_ioctl+0x316/0xb00
__x64_sys_ioctl+0xa3/0x100
x64_sys_call+0x281/0x23d0
do_syscall_64+0xba/0x550
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x79bb30deb04b
</TASK>
---[ end trace ]---
Fixes: 37be407b2ce8 ("KVM: nSVM: Fix L1 state corruption upon return from SMM")
Cc: stable@vger.kernel.org
Reported-by: Bill Wendling <morbo@google.com>
Reported-by: Stefan Teodorescu <fane@google.com>
Tested-by: Stefan Teodorescu <fane@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20261022021046.295001-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
arch/x86/kvm/svm/nested.c | 23 ++++++++++++++++-------
arch/x86/kvm/svm/svm.c | 2 ++
arch/x86/kvm/svm/svm.h | 2 ++
3 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index af0ef678433d..07554089ec05 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1889,6 +1889,21 @@ static void nested_copy_vmcb_cache_to_control(struct vmcb_control_area *dst,
/* 'clean' and 'hv_enlightenments' are not changed by KVM */
}
+bool nested_svm_check_vmcb01_save(struct kvm_vcpu *vcpu,
+ struct vmcb_save_area *save)
+{
+ struct vmcb_save_area_cached save_cached;
+
+ if (!(save->cr0 & X86_CR0_PG) ||
+ !(save->cr0 & X86_CR0_PE) ||
+ (save->rflags & X86_EFLAGS_VM) ||
+ ((save->efer & EFER_LMA) && !(save->efer & EFER_LME)))
+ return false;
+
+ __nested_copy_vmcb_save_to_cache(&save_cached, save);
+ return nested_vmcb_check_save(vcpu, &save_cached, false);
+}
+
static int svm_get_nested_state(struct kvm_vcpu *vcpu,
struct kvm_nested_state __user *user_kvm_nested_state,
u32 user_data_size)
@@ -1968,7 +1983,6 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
&user_kvm_nested_state->data.svm[0];
struct vmcb_control_area *ctl;
struct vmcb_save_area *save;
- struct vmcb_save_area_cached save_cached;
struct vmcb_ctrl_area_cached ctl_cached;
bool use_separate_l2_pat;
unsigned long cr0;
@@ -2040,12 +2054,7 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
* KVM_GET_NESTED_STATE, and (b) it is not loaded at emulated
* #VMEXIT.
*/
- __nested_copy_vmcb_save_to_cache(&save_cached, save);
- if (!(save->cr0 & X86_CR0_PG) ||
- !(save->cr0 & X86_CR0_PE) ||
- (save->rflags & X86_EFLAGS_VM) ||
- ((save->efer & EFER_LMA) && !(save->efer & EFER_LME)) ||
- !nested_vmcb_check_save(vcpu, &save_cached, false))
+ if (!nested_svm_check_vmcb01_save(vcpu, save))
goto out_free;
/*
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 487897ef11dd..581bc3a23c95 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -5219,6 +5219,8 @@ static int svm_leave_smm(struct kvm_vcpu *vcpu, const union kvm_smram *smram)
*/
svm_copy_vmrun_state(vcpu, &svm->vmcb01.ptr->save, m_save.map.hva + 0x400);
+ if (!nested_svm_check_vmcb01_save(vcpu, &svm->vmcb01.ptr->save))
+ return 1;
/*
* Enter the nested guest now
diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
index 4b0b2ee13a3a..b9f7786bf17c 100644
--- a/arch/x86/kvm/svm/svm.h
+++ b/arch/x86/kvm/svm/svm.h
@@ -911,6 +911,8 @@ void nested_copy_vmcb_control_to_cache(struct vcpu_svm *svm,
void nested_copy_vmcb_save_to_cache(struct vcpu_svm *svm,
struct vmcb_save_area *save);
void nested_sync_control_from_vmcb02(struct vcpu_svm *svm);
+bool nested_svm_check_vmcb01_save(struct kvm_vcpu *vcpu,
+ struct vmcb_save_area *save);
void svm_switch_vmcb(struct vcpu_svm *svm, struct kvm_vmcb_info *target_vmcb);
--
2.52.0
next prev parent reply other threads:[~2026-11-02 23:14 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-02 23:14 [PATCH 0/7] KVM: a bunch of fixes Paolo Bonzini
2026-11-02 23:14 ` Paolo Bonzini [this message]
2026-11-02 23:14 ` [PATCH 2/7] KVM: x86/mmu: Conditionally resched when retrying gPTE walk on A/D update failure Paolo Bonzini
2026-11-02 23:14 ` [PATCH 3/7] KVM: x86: Conditionally resched when restarting REP string emulation Paolo Bonzini
2026-11-02 23:14 ` [PATCH 4/7] KVM: nVMX: Process each host MSR entry at most once when unwinding failed VM-Entry Paolo Bonzini
2026-11-02 23:39 ` Jim Mattson
2026-11-03 0:10 ` Sean Christopherson
2026-11-03 0:34 ` Jim Mattson
2026-11-02 23:14 ` [PATCH 5/7] KVM: x86/mmu: Cap number of parent PTEs per SP at 1000 (the arbitrary rmap limit) Paolo Bonzini
2026-11-02 23:14 ` [PATCH 6/7] KVM: x86: Unconditionally reset MMU context when emulating INIT Paolo Bonzini
2026-11-02 23:14 ` [PATCH 7/7] KVM: x86: Flush guest TLB when emulating a RESET to strictly honor the spec Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261102231428.13523-2-pbonzini@redhat.com \
--to=pbonzini@redhat.com \
--cc=fane@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=morbo@google.com \
--cc=seanjc@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®