Wanpeng Li 95e057e258 KVM: X86: Fix SMRAM accessing even if VM is shutdown ... Reported by syzkaller: WARNING: CPU: 6 PID: 2434 at arch/x86/kvm/vmx.c:6660 handle_ept_misconfig+0x54/0x1e0 [kvm_intel] CPU: 6 PID: 2434 Comm: repro_test Not tainted 4.15.0+ #4 RIP: 0010:handle_ept_misconfig+0x54/0x1e0 [kvm_intel] Call Trace: vmx_handle_exit+0xbd/0xe20 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xdaf/0x1d50 [kvm] kvm_vcpu_ioctl+0x3e9/0x720 [kvm] do_vfs_ioctl+0xa4/0x6a0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x25/0x9c The testcase creates a first thread to issue KVM_SMI ioctl, and then creates a second thread to mmap and operate on the same vCPU. This triggers a race condition when running the testcase with multiple threads. Sometimes one thread exits with a triple fault while another thread mmaps and operates on the same vCPU. Because CS=0x3000/IP=0x8000 is not mapped, accessing the SMI handler results in an EPT misconfig. This patch fixes it by returning RET_PF_EMULATE in kvm_handle_bad_page(), which will go on to cause an emulation failure and an exit with KVM_EXIT_INTERNAL_ERROR. Reported-by: syzbot+c1d9517cab094dae65e446c0c5b4de6c40f4dc58@syzkaller.appspotmail.com Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Radim Krčmář <rkrcmar@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Wanpeng Li <wanpengli@tencent.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		2018-02-24 01:43:37 +01:00
..
alpha	pci-v4.16-changes	2018-02-06 09:59:40 -08:00
arc	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
arm	ARM: kvm: fix building with gcc-8	2018-02-15 20:58:36 +01:00
arm64	KVM changes for 4.16	2018-02-10 13:16:35 -08:00
blackfin	unify {de,}mangle_poll(), get rid of kernel-side POLL...	2018-02-11 14:37:22 -08:00
c6x	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
cris	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
frv	unify {de,}mangle_poll(), get rid of kernel-side POLL...	2018-02-11 14:37:22 -08:00
h8300	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
hexagon	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
ia64	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
m32r	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
m68k	unify {de,}mangle_poll(), get rid of kernel-side POLL...	2018-02-11 14:37:22 -08:00
metag	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
microblaze	Microblaze patches for 4.16-rc1	2018-02-02 09:48:36 -08:00
mips	unify {de,}mangle_poll(), get rid of kernel-side POLL...	2018-02-11 14:37:22 -08:00
mn10300	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
nios2	nios2 update for v4.16-rc1	2018-02-11 13:52:32 -08:00
openrisc	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
parisc	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
powerpc	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
riscv	RISC-V changes for 4.16	2018-02-07 11:33:08 -08:00
s390	KVM: s390: provide only a single function for setting the tod (fix SCK)	2018-02-20 20:51:28 +00:00
score	arch/score/kernel/setup.c: combine two seq_printf() calls into one call in show_cpuinfo()	2018-02-06 18:32:47 -08:00
sh	libnvdimm for 4.16	2018-02-06 10:41:33 -08:00
sparc	unify {de,}mangle_poll(), get rid of kernel-side POLL...	2018-02-11 14:37:22 -08:00
tile	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
um	mconsole_proc(): don't mess with file->f_pos	2018-02-09 19:28:01 -08:00
unicore32	lib: optimize cpumask_next_and()	2018-02-06 18:32:44 -08:00
x86	KVM: X86: Fix SMRAM accessing even if VM is shutdown	2018-02-24 01:43:37 +01:00
xtensa	unify {de,}mangle_poll(), get rid of kernel-side POLL...	2018-02-11 14:37:22 -08:00
.gitignore
Kconfig	Makefile: introduce CONFIG_CC_STACKPROTECTOR_AUTO	2018-02-06 18:32:44 -08:00