lkml.org 
[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] KVM: X86: Fix async pf caused null-ptr-deref
From
Date
On 29/06/20 12:26, Wanpeng Li wrote:
> From: Wanpeng Li <wanpengli@tencent.com>
>
> Syzbot reported that:
>
> CPU: 1 PID: 6780 Comm: syz-executor153 Not tainted 5.7.0-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> RIP: 0010:__apic_accept_irq+0x46/0xb80
> Call Trace:
> kvm_arch_async_page_present+0x7de/0x9e0
> kvm_check_async_pf_completion+0x18d/0x400
> kvm_arch_vcpu_ioctl_run+0x18bf/0x69f0
> kvm_vcpu_ioctl+0x46a/0xe20
> ksys_ioctl+0x11a/0x180
> __x64_sys_ioctl+0x6f/0xb0
> do_syscall_64+0xf6/0x7d0
> entry_SYSCALL_64_after_hwframe+0x49/0xb3
>
> The testcase enables APF mechanism in MSR_KVM_ASYNC_PF_EN with ASYNC_PF_INT
> enabled w/o setting MSR_KVM_ASYNC_PF_INT before, what's worse, interrupt
> based APF 'page ready' event delivery depends on in kernel lapic, however,
> we didn't bail out when lapic is not in kernel during guest setting
> MSR_KVM_ASYNC_PF_EN which causes the null-ptr-deref in host later.
> This patch fixes it.
>
> Reported-by: syzbot+1bf777dfdde86d64b89b@syzkaller.appspotmail.com
> Fixes: 2635b5c4a0 (KVM: x86: interrupt based APF 'page ready' event delivery)
> Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
> ---
> arch/x86/kvm/x86.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 00c88c2..1c0b4f5 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -2693,6 +2693,9 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
> if (data & 0x30)
> return 1;
>
> + if (!lapic_in_kernel(vcpu))
> + return 1;
> +
> vcpu->arch.apf.msr_en_val = data;
>
> if (!kvm_pv_async_pf_enabled(vcpu)) {
>

Queued, thanks.

Paolo

\
 
 \ /
  Last update: 2020-06-29 21:06    [W:0.103 / U:21.804 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site