From nobody Mon Jun 15 07:24:08 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9EDEC433EF for ; Mon, 2 May 2022 22:19:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239918AbiEBWW2 (ORCPT ); Mon, 2 May 2022 18:22:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230490AbiEBWWZ (ORCPT ); Mon, 2 May 2022 18:22:25 -0400 Received: from mail-pj1-x1049.google.com (mail-pj1-x1049.google.com [IPv6:2607:f8b0:4864:20::1049]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AE1B92AD for ; Mon, 2 May 2022 15:18:53 -0700 (PDT) Received: by mail-pj1-x1049.google.com with SMTP id a23-20020a17090a6d9700b001d60327d73aso273988pjk.7 for ; Mon, 02 May 2022 15:18:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=reply-to:date:message-id:mime-version:subject:from:to:cc; bh=TXIIJNLl5tS81cj1e6Sb3BybyFnRD2QLWwcLwhsiYDs=; b=Qa0ikLUOxl2s5X8Ry8796VJb+tcDzIXLzrUSN7TnPSNNudW3bfEOQOU0kLfq1hxTfN IP0sESs7FFstPfBGMaVlPw3HKJgDcJGjTmkSLqd0UrTUQtGrrOhmhHaEUYguiGrFlYpi XX6v9u/nMe9PUrknwsQNDkHoJxoVXIQ2wh/eH25qHwZnKU/rnkU+MdkHiS3BC1oHQHOZ ec8cSZKZ6NgLQEGvkV5zimwoWmRB8l7ztqb2//HE10AiNxDZOLT6df1hYp9p/CZGSAN7 WU8sq/BbQhJhtywBCzi4+sBjdWtrTkNbehr+5R6iHdwswF7JtkjD7Jo+AS2tZUokyc/C eXjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:reply-to:date:message-id:mime-version:subject :from:to:cc; bh=TXIIJNLl5tS81cj1e6Sb3BybyFnRD2QLWwcLwhsiYDs=; b=X/A4SoyRNHOOVypGclEBNCq7YX+NjQxq+S4NcgWAq5KQ+I7jcLPZ/AyZSKM4jgEwv2 NGoB5i6BRlEilEr/3XJjfs+uB5Khqjftxdpdo0gJPqyjVm2eH0lYDYUTumLUltLE1jHm OCWNYcURNNqjX66AJAwuz4Wk5kMs1ZzVhrSjzDYtsznU4/kuE4pTX9DSs+kNU1k6uBis VXWnP7GdvvSVUzn+EQ07dGLGQjQIIXE30Dse0ZnDvmZ690STVNDCZiqvL15TnZePziuw dRw6A+SxRrBfp8DxWTbvTBGAwiZOfr3kQGUlhRoeKhWoDB3/1ioXr8207wxb34Df7bm6 KF8A== X-Gm-Message-State: AOAM530jIlhWx8lz8glyjCNDeTTjoQdJS0RGajN26uzYxSiJ6QeT63VM RO01E3fPrDtwksy1g8FnqXxD0kr/hQI= X-Google-Smtp-Source: ABdhPJzAB+fTD/4HJyBSgaZ6B+/uiqDSapY8Q+Y3yfuxmKFMC3Uamz17CxAwrCKbS6zRQaerkilOVz5CgnQ= X-Received: from seanjc.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:3e5]) (user=seanjc job=sendgmr) by 2002:a17:90a:c986:b0:1d9:56e7:4e83 with SMTP id w6-20020a17090ac98600b001d956e74e83mr149900pjt.1.1651529932080; Mon, 02 May 2022 15:18:52 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 2 May 2022 22:18:50 +0000 Message-Id: <20220502221850.131873-1-seanjc@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.36.0.464.gb9c8b46e94-goog Subject: [PATCH] KVM: VMX: Exit to userspace if vCPU has injected exception and invalid state From: Sean Christopherson To: Paolo Bonzini Cc: Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+cfafed3bb76d3e37581b@syzkaller.appspotmail.com Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Exit to userspace with an emulation error if KVM encounters an injected exception with invalid guest state, in addition to the existing check of bailing if there's a pending exception (KVM doesn't support emulating exceptions except when emulating real mode via vm86). In theory, KVM should never get to such a situation as KVM is supposed to exit to userspace before injecting an exception with invalid guest state. But in practice, userspace can intervene and manually inject an exception and/or stuff registers to force invalid guest state while a previously injected exception is awaiting reinjection. Fixes: fc4fad79fc3d ("KVM: VMX: Reject KVM_RUN if emulation is required wit= h pending exception") Reported-by: syzbot+cfafed3bb76d3e37581b@syzkaller.appspotmail.com Signed-off-by: Sean Christopherson --- arch/x86/kvm/vmx/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index cf8581978bce..c41f0ac700c7 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -5465,7 +5465,7 @@ static bool vmx_emulation_required_with_pending_excep= tion(struct kvm_vcpu *vcpu) struct vcpu_vmx *vmx =3D to_vmx(vcpu); =20 return vmx->emulation_required && !vmx->rmode.vm86_active && - vcpu->arch.exception.pending; + (vcpu->arch.exception.pending || vcpu->arch.exception.injected); } =20 static int handle_invalid_guest_state(struct kvm_vcpu *vcpu) base-commit: 84e5ffd045f33e4fa32370135436d987478d0bf7 --=20 2.36.0.464.gb9c8b46e94-goog