* [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA
@ 2017-12-11 23:23 Lan Tianyu
2017-12-12 6:42 ` Wanpeng Li
2017-12-12 12:16 ` Paolo Bonzini
0 siblings, 2 replies; 4+ messages in thread
From: Lan Tianyu @ 2017-12-11 23:23 UTC (permalink / raw)
Cc: Lan Tianyu, pbonzini, rkrcmar, tglx, mingo, hpa, x86, kvm,
linux-kernel, dvyukov, jmattson, Wanpeng Li
Reported by syzkaller:
WARNING: CPU: 0 PID: 27962 at arch/x86/kvm/emulate.c:5631 x86_emulate_insn+0x557/0x15f0 [kvm]
Modules linked in: kvm_intel kvm [last unloaded: kvm]
CPU: 0 PID: 27962 Comm: syz-executor Tainted: G B W 4.15.0-rc2-next-20171208+ #32
Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.01.03.0006.040720161253 04/07/2016
RIP: 0010:x86_emulate_insn+0x557/0x15f0 [kvm]
RSP: 0018:ffff8807234476d0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff88072d0237a0 RCX: ffffffffa0065c4d
RDX: 1ffff100e5a046f9 RSI: 0000000000000003 RDI: ffff88072d0237c8
RBP: ffff880723447728 R08: ffff88072d020000 R09: ffffffffa008d240
R10: 0000000000000002 R11: ffffed00e7d87db3 R12: ffff88072d0237c8
R13: ffff88072d023870 R14: ffff88072d0238c2 R15: ffffffffa008d080
FS: 00007f8a68666700(0000) GS:ffff880802200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002009506c CR3: 000000071fec4005 CR4: 00000000003626f0
Call Trace:
x86_emulate_instruction+0x3bc/0xb70 [kvm]
? reexecute_instruction.part.162+0x130/0x130 [kvm]
vmx_handle_exit+0x46d/0x14f0 [kvm_intel]
? trace_event_raw_event_kvm_entry+0xe7/0x150 [kvm]
? handle_vmfunc+0x2f0/0x2f0 [kvm_intel]
? wait_lapic_expire+0x25/0x270 [kvm]
vcpu_enter_guest+0x720/0x1ef0 [kvm]
...
Syzkaller tests KVM emulation code path with setting RSP 0xffffffffffffffff
and running in 64bit non paging mode. It triggers warning that exception
vector is > 1f(it's initialized to be 0xff in x86_emulate_instruction())
during emulation of pop instruction. This is due to pop emulation callback
em_pop() returns X86EMUL_PROPAGATE_FAULT while not populate exception
vector. POP emulation code accesses RSP with linear address
0xffffffffffffffff and KVM mmu returns GVA as GPA during nonpaging mode.
In this case, GPA 0xffffffffffffffff(~0) conflicts with error code
UNMAPPED_GVA which is defined to be (~(u64)0). Caller vcpu_mmio_gva_to
_gpa() treats the return address as error and this also causes emulator
_read_write_onepage() returns X86EMUL_PROPAGATE_FAULT without a validated
exception vector.
This patch is to mask linear address with address width to fix such issue
since linear address won't occupy all 64-bit even if in 5 level paging
mode.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Jim Mattson <jmattson@google.com>
Cc: Wanpeng Li <kernellwp@gmail.com>
Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
---
arch/x86/kvm/emulate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index abe74f7..9b21412 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -697,8 +697,8 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
*max_size = 0;
switch (mode) {
case X86EMUL_MODE_PROT64:
- *linear = la;
va_bits = ctxt_virt_addr_bits(ctxt);
+ *linear = la & ((1ul << va_bits) - 1);
if (get_canonical(la, va_bits) != la)
goto bad;
--
1.8.3.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA
2017-12-11 23:23 [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA Lan Tianyu
@ 2017-12-12 6:42 ` Wanpeng Li
2017-12-12 6:51 ` Lan Tianyu
2017-12-12 12:16 ` Paolo Bonzini
1 sibling, 1 reply; 4+ messages in thread
From: Wanpeng Li @ 2017-12-12 6:42 UTC (permalink / raw)
To: Lan Tianyu
Cc: Paolo Bonzini, Radim Krcmar, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, the arch/x86 maintainers, kvm, linux-kernel,
Dmitry Vyukov, Jim Mattson
2017-12-12 7:23 GMT+08:00 Lan Tianyu <tianyu.lan@intel.com>:
>
> Reported by syzkaller:
> WARNING: CPU: 0 PID: 27962 at arch/x86/kvm/emulate.c:5631 x86_emulate_insn+0x557/0x15f0 [kvm]
> Modules linked in: kvm_intel kvm [last unloaded: kvm]
> CPU: 0 PID: 27962 Comm: syz-executor Tainted: G B W 4.15.0-rc2-next-20171208+ #32
> Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.01.03.0006.040720161253 04/07/2016
> RIP: 0010:x86_emulate_insn+0x557/0x15f0 [kvm]
> RSP: 0018:ffff8807234476d0 EFLAGS: 00010282
> RAX: 0000000000000000 RBX: ffff88072d0237a0 RCX: ffffffffa0065c4d
> RDX: 1ffff100e5a046f9 RSI: 0000000000000003 RDI: ffff88072d0237c8
> RBP: ffff880723447728 R08: ffff88072d020000 R09: ffffffffa008d240
> R10: 0000000000000002 R11: ffffed00e7d87db3 R12: ffff88072d0237c8
> R13: ffff88072d023870 R14: ffff88072d0238c2 R15: ffffffffa008d080
> FS: 00007f8a68666700(0000) GS:ffff880802200000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000000002009506c CR3: 000000071fec4005 CR4: 00000000003626f0
> Call Trace:
> x86_emulate_instruction+0x3bc/0xb70 [kvm]
> ? reexecute_instruction.part.162+0x130/0x130 [kvm]
> vmx_handle_exit+0x46d/0x14f0 [kvm_intel]
> ? trace_event_raw_event_kvm_entry+0xe7/0x150 [kvm]
> ? handle_vmfunc+0x2f0/0x2f0 [kvm_intel]
> ? wait_lapic_expire+0x25/0x270 [kvm]
> vcpu_enter_guest+0x720/0x1ef0 [kvm]
> ...
>
> Syzkaller tests KVM emulation code path with setting RSP 0xffffffffffffffff
> and running in 64bit non paging mode. It triggers warning that exception
> vector is > 1f(it's initialized to be 0xff in x86_emulate_instruction())
> during emulation of pop instruction. This is due to pop emulation callback
> em_pop() returns X86EMUL_PROPAGATE_FAULT while not populate exception
> vector. POP emulation code accesses RSP with linear address
> 0xffffffffffffffff and KVM mmu returns GVA as GPA during nonpaging mode.
> In this case, GPA 0xffffffffffffffff(~0) conflicts with error code
> UNMAPPED_GVA which is defined to be (~(u64)0). Caller vcpu_mmio_gva_to
> _gpa() treats the return address as error and this also causes emulator
> _read_write_onepage() returns X86EMUL_PROPAGATE_FAULT without a validated
> exception vector.
>
> This patch is to mask linear address with address width to fix such issue
> since linear address won't occupy all 64-bit even if in 5 level paging
> mode.
>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Radim Krčmář <rkrcmar@redhat.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Jim Mattson <jmattson@google.com>
> Cc: Wanpeng Li <kernellwp@gmail.com>
> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
Tested-by: Wanpeng Li <wanpeng.li@hotmail.com>
> ---
> arch/x86/kvm/emulate.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index abe74f7..9b21412 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -697,8 +697,8 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
> *max_size = 0;
> switch (mode) {
> case X86EMUL_MODE_PROT64:
> - *linear = la;
> va_bits = ctxt_virt_addr_bits(ctxt);
> + *linear = la & ((1ul << va_bits) - 1);
> if (get_canonical(la, va_bits) != la)
> goto bad;
>
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Re: [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA
2017-12-12 6:42 ` Wanpeng Li
@ 2017-12-12 6:51 ` Lan Tianyu
0 siblings, 0 replies; 4+ messages in thread
From: Lan Tianyu @ 2017-12-12 6:51 UTC (permalink / raw)
To: Wanpeng Li
Cc: Paolo Bonzini, Radim Krcmar, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, the arch/x86 maintainers, kvm, linux-kernel,
Dmitry Vyukov, Jim Mattson
On 2017年12月12日 14:42, Wanpeng Li wrote:
> 2017-12-12 7:23 GMT+08:00 Lan Tianyu <tianyu.lan@intel.com>:
>>
>> Reported by syzkaller:
>> WARNING: CPU: 0 PID: 27962 at arch/x86/kvm/emulate.c:5631 x86_emulate_insn+0x557/0x15f0 [kvm]
>> Modules linked in: kvm_intel kvm [last unloaded: kvm]
>> CPU: 0 PID: 27962 Comm: syz-executor Tainted: G B W 4.15.0-rc2-next-20171208+ #32
>> Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.01.03.0006.040720161253 04/07/2016
>> RIP: 0010:x86_emulate_insn+0x557/0x15f0 [kvm]
>> RSP: 0018:ffff8807234476d0 EFLAGS: 00010282
>> RAX: 0000000000000000 RBX: ffff88072d0237a0 RCX: ffffffffa0065c4d
>> RDX: 1ffff100e5a046f9 RSI: 0000000000000003 RDI: ffff88072d0237c8
>> RBP: ffff880723447728 R08: ffff88072d020000 R09: ffffffffa008d240
>> R10: 0000000000000002 R11: ffffed00e7d87db3 R12: ffff88072d0237c8
>> R13: ffff88072d023870 R14: ffff88072d0238c2 R15: ffffffffa008d080
>> FS: 00007f8a68666700(0000) GS:ffff880802200000(0000) knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 000000002009506c CR3: 000000071fec4005 CR4: 00000000003626f0
>> Call Trace:
>> x86_emulate_instruction+0x3bc/0xb70 [kvm]
>> ? reexecute_instruction.part.162+0x130/0x130 [kvm]
>> vmx_handle_exit+0x46d/0x14f0 [kvm_intel]
>> ? trace_event_raw_event_kvm_entry+0xe7/0x150 [kvm]
>> ? handle_vmfunc+0x2f0/0x2f0 [kvm_intel]
>> ? wait_lapic_expire+0x25/0x270 [kvm]
>> vcpu_enter_guest+0x720/0x1ef0 [kvm]
>> ...
>>
>> Syzkaller tests KVM emulation code path with setting RSP 0xffffffffffffffff
>> and running in 64bit non paging mode. It triggers warning that exception
>> vector is > 1f(it's initialized to be 0xff in x86_emulate_instruction())
>> during emulation of pop instruction. This is due to pop emulation callback
>> em_pop() returns X86EMUL_PROPAGATE_FAULT while not populate exception
>> vector. POP emulation code accesses RSP with linear address
>> 0xffffffffffffffff and KVM mmu returns GVA as GPA during nonpaging mode.
>> In this case, GPA 0xffffffffffffffff(~0) conflicts with error code
>> UNMAPPED_GVA which is defined to be (~(u64)0). Caller vcpu_mmio_gva_to
>> _gpa() treats the return address as error and this also causes emulator
>> _read_write_onepage() returns X86EMUL_PROPAGATE_FAULT without a validated
>> exception vector.
>>
>> This patch is to mask linear address with address width to fix such issue
>> since linear address won't occupy all 64-bit even if in 5 level paging
>> mode.
>>
>> Reported-by: Dmitry Vyukov <dvyukov@google.com>
>> Cc: Paolo Bonzini <pbonzini@redhat.com>
>> Cc: Radim Krčmář <rkrcmar@redhat.com>
>> Cc: Dmitry Vyukov <dvyukov@google.com>
>> Cc: Jim Mattson <jmattson@google.com>
>> Cc: Wanpeng Li <kernellwp@gmail.com>
>> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
>
> Tested-by: Wanpeng Li <wanpeng.li@hotmail.com>
>
Thanks a lot.
--
Best regards
Tianyu Lan
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA
2017-12-11 23:23 [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA Lan Tianyu
2017-12-12 6:42 ` Wanpeng Li
@ 2017-12-12 12:16 ` Paolo Bonzini
1 sibling, 0 replies; 4+ messages in thread
From: Paolo Bonzini @ 2017-12-12 12:16 UTC (permalink / raw)
To: Lan Tianyu
Cc: rkrcmar, tglx, mingo, hpa, x86, kvm, linux-kernel, dvyukov,
jmattson, Wanpeng Li
On 12/12/2017 00:23, Lan Tianyu wrote:
>
> Reported by syzkaller:
> WARNING: CPU: 0 PID: 27962 at arch/x86/kvm/emulate.c:5631 x86_emulate_insn+0x557/0x15f0 [kvm]
> Modules linked in: kvm_intel kvm [last unloaded: kvm]
> CPU: 0 PID: 27962 Comm: syz-executor Tainted: G B W 4.15.0-rc2-next-20171208+ #32
> Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.01.03.0006.040720161253 04/07/2016
> RIP: 0010:x86_emulate_insn+0x557/0x15f0 [kvm]
> RSP: 0018:ffff8807234476d0 EFLAGS: 00010282
> RAX: 0000000000000000 RBX: ffff88072d0237a0 RCX: ffffffffa0065c4d
> RDX: 1ffff100e5a046f9 RSI: 0000000000000003 RDI: ffff88072d0237c8
> RBP: ffff880723447728 R08: ffff88072d020000 R09: ffffffffa008d240
> R10: 0000000000000002 R11: ffffed00e7d87db3 R12: ffff88072d0237c8
> R13: ffff88072d023870 R14: ffff88072d0238c2 R15: ffffffffa008d080
> FS: 00007f8a68666700(0000) GS:ffff880802200000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000000002009506c CR3: 000000071fec4005 CR4: 00000000003626f0
> Call Trace:
> x86_emulate_instruction+0x3bc/0xb70 [kvm]
> ? reexecute_instruction.part.162+0x130/0x130 [kvm]
> vmx_handle_exit+0x46d/0x14f0 [kvm_intel]
> ? trace_event_raw_event_kvm_entry+0xe7/0x150 [kvm]
> ? handle_vmfunc+0x2f0/0x2f0 [kvm_intel]
> ? wait_lapic_expire+0x25/0x270 [kvm]
> vcpu_enter_guest+0x720/0x1ef0 [kvm]
> ...
>
> Syzkaller tests KVM emulation code path with setting RSP 0xffffffffffffffff
> and running in 64bit non paging mode. It triggers warning that exception
> vector is > 1f(it's initialized to be 0xff in x86_emulate_instruction())
> during emulation of pop instruction. This is due to pop emulation callback
> em_pop() returns X86EMUL_PROPAGATE_FAULT while not populate exception
> vector. POP emulation code accesses RSP with linear address
> 0xffffffffffffffff and KVM mmu returns GVA as GPA during nonpaging mode.
> In this case, GPA 0xffffffffffffffff(~0) conflicts with error code
> UNMAPPED_GVA which is defined to be (~(u64)0). Caller vcpu_mmio_gva_to
> _gpa() treats the return address as error and this also causes emulator
> _read_write_onepage() returns X86EMUL_PROPAGATE_FAULT without a validated
> exception vector.
>
> This patch is to mask linear address with address width to fix such issue
> since linear address won't occupy all 64-bit even if in 5 level paging
> mode.
This makes no sense, it will break access to the top half of the address
space.
The root cause of the issue is that 64-bit non-paging mode doesn't
exist. KVM_SET_SREGS is not validating the input correctly; it should
have failed.
Paolo
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Radim Krčmář <rkrcmar@redhat.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Jim Mattson <jmattson@google.com>
> Cc: Wanpeng Li <kernellwp@gmail.com>
> Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
> ---
> arch/x86/kvm/emulate.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index abe74f7..9b21412 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -697,8 +697,8 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt,
> *max_size = 0;
> switch (mode) {
> case X86EMUL_MODE_PROT64:
> - *linear = la;
> va_bits = ctxt_virt_addr_bits(ctxt);
> + *linear = la & ((1ul << va_bits) - 1);
> if (get_canonical(la, va_bits) != la)
> goto bad;
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-12-12 12:16 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-12-11 23:23 [PATCH] KVM/Emulate: Mask linear address with actual address width in order to avoid conflict with UNMAPPED_GVA Lan Tianyu
2017-12-12 6:42 ` Wanpeng Li
2017-12-12 6:51 ` Lan Tianyu
2017-12-12 12:16 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®