github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-16 04:39:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/arch/x86/kvm/vmx
History
Amirmohammad Eftekhar c8f4cfe1cf KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry 
Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails
in the "not from VM-Entry" case, i.e. when emulating RSM or handling
KVM_SET_NESTED_STATE.  Failure to unwind the MMU pointer results in KVM
trying to run L1 with a nested MMU, and is especially problematic if the
vCPU manages to free its nested state before the VM crashes.  Constructing
the root for a nested EPT MMU goes through vmcs12, which is dynamically
allocated/freed when nVMX is enabled/disabled.  And so if the nested state
is freed with the MMU still pointing at the nested MMU, KVM will hit a NULL
pointer deref when attempting to get L1=>L2 EPTP.

  BUG: kernel NULL pointer dereference, address: 0000000000000078
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0
  Oops: Oops: 0000 [#1] SMP
  CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]
  Call Trace:
   <TASK>
   kvm_mmu_load+0xcd/0x870 [kvm]
   kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm]
   kvm_vcpu_ioctl+0x2c7/0x970 [kvm]
   __x64_sys_ioctl+0x90/0xd0
   do_syscall_64+0x9c/0x4d0
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x47491b
   </TASK>
  Modules linked in: kvm_intel kvm irqbypass
  CR2: 0000000000000078
  ---[ end trace 0000000000000000 ]---
  RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel]

Cc: David Woodhouse <dwmw2@infradead.org>
Fixes: 72e9cbdb43 ("KVM: nVMX: fix SMI injection in guest mode")
Fixes: 8fcc4b5923 ("kvm: nVMX: Introduce KVM_CAP_NESTED_STATE")
Cc: stable@vger.kernel.org
Signed-off-by: Amirmohammad Eftekhar <amirmohammadeftekhar@gmail.com>
[sean: write changelog]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Link: https://patch.msgid.link/20261001214356.3825100-2-seanjc@google.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-10-14 16:42:40 +02:00
..
capabilities.h Merge branch 'kvm-ghcb-for-7.2' into HEAD 2026-06-03 17:00:06 +02:00
common.h KVM: nVMX: pass PFERR_USER_MASK to MMU on EPT violations 2026-05-10 14:55:06 +02:00
hyperv_evmcs.c KVM: VMX: Add a wrapper around ROL16() to get a vmcs12 from a field encoding 2026-01-16 07:48:00 -08:00
hyperv_evmcs.h KVM: nVMX: allow MBEC with EVMCS 2026-05-10 14:55:07 +02:00
hyperv.c
hyperv.h
main.c KVM x86 misc changes for 7.3 2026-08-18 13:41:51 +02:00
nested.c KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry 2026-10-14 16:42:40 +02:00
nested.h KVM: Move nVMX's lockdep logic for vcpu->mutex to a common helper 2026-07-08 13:41:12 -07:00
pmu_intel.c KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() 2026-09-11 12:02:07 -07:00
pmu_intel.h KVM: x86/pmu: Disable interception of select PMU MSRs for mediated vPMUs 2026-01-08 11:52:08 -08:00
posted_intr.c KVM: VMX: WARN if VT-d Posted IRQs aren't possible when starting IRQ bypass 2025-06-23 09:50:47 -07:00
posted_intr.h KVM: x86: Decouple device assignment from IRQ bypass 2025-06-23 09:50:46 -07:00
sgx.c Arm: 2026-06-19 08:56:49 -07:00
sgx.h
tdx_arch.h KVM/TDX: Remove redundant definitions of TDX_TD_ATTR_* 2026-03-03 16:06:49 -08:00
tdx.c KVM: Reject attempts to lock all vCPUs if vCPU creation is in-progress 2026-09-26 00:49:49 -04:00
tdx.h x86/tdx: Move TDX architectural error codes into <asm/shared/tdx_errno.h> 2026-04-27 15:13:38 -07:00
vmcs_shadow_fields.h KVM: x86: Immediately fail the build when possible if required #define is missing 2026-03-12 10:56:36 -07:00
vmcs.h KVM: VMX: Move architectural "vmcs" and "vmcs_hdr" structures to public vmx.h 2026-03-04 08:52:26 -08:00
vmcs12.c KVM: nVMX: Disallow access to vmcs12 fields that aren't supported by "hardware" 2026-01-26 06:23:51 -08:00
vmcs12.h KVM: nVMX: Disallow access to vmcs12 fields that aren't supported by "hardware" 2026-01-26 06:23:51 -08:00
vmenter.S Merge branch 'kvm-ghcb-for-7.2' into HEAD 2026-06-03 17:00:06 +02:00
vmx_onhyperv.c
vmx_onhyperv.h
vmx_ops.h KVM: VMX: add memory clobber to asm for VMX instructions 2026-07-28 17:43:28 +02:00
vmx.c Arm: 2026-08-25 11:48:04 -07:00
vmx.h KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3 when EPT is disabled 2026-07-08 10:50:37 -07:00
x86_ops.h KVM x86 misc changes for 7.3 2026-08-18 13:41:51 +02:00