From nobody Sat Apr 25 11:48:31 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAF77C43334 for ; Mon, 11 Jul 2022 23:28:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231528AbiGKX2Q (ORCPT ); Mon, 11 Jul 2022 19:28:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47702 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229752AbiGKX2N (ORCPT ); Mon, 11 Jul 2022 19:28:13 -0400 Received: from mail-pg1-x549.google.com (mail-pg1-x549.google.com [IPv6:2607:f8b0:4864:20::549]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B03A189ABA for ; Mon, 11 Jul 2022 16:28:12 -0700 (PDT) Received: by mail-pg1-x549.google.com with SMTP id 196-20020a6300cd000000b0040c9c64e7e4so2450885pga.9 for ; Mon, 11 Jul 2022 16:28:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=reply-to:date:in-reply-to:message-id:mime-version:references :subject:from:to:cc; bh=Y4c9+hRyXDtn+HmMTY8LBUAXVpb8i20If3SwC4b4N10=; b=GOCG7wXwJDxav8DI1JKokVLWSeeeAe5t3C9q4/j0GVaKqzLkuo38RYOe27JrYuldnh cQqaShlay2vxnFPl8uPzovSvzyQDlwGosD1hsPkBswnfl1Cb42jlFMT93jdKLD3BR5Zd ai/QhN2ho/28LYidGARFUjr6DEM6TlNjDv+MRMcY+r6DjBaFbTAoy8wonS/hHVu7DS7I UFB6VpfIDXNUFnic5AsuTCR0wwTGtehvYa+BOa+UCbkbhT6/qf4suunrKOGAClZozuqQ qEAppRWbpavzENbRUC+WpnMwKO0CzbcPV7tLbO1zuOwAtkJVQSGWwecH+CYEnYRSiHSb 1CiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:reply-to:date:in-reply-to:message-id :mime-version:references:subject:from:to:cc; bh=Y4c9+hRyXDtn+HmMTY8LBUAXVpb8i20If3SwC4b4N10=; b=8CfV+QeVKt0UZeicavaXsN9EZxHDEilLPcPr5xYfjpRQZiEaBoNrfgTPGnpCNCJgU4 eLyFkCr1NogeaEKNxwHVIPNcv95x/G7271rvNxWUFc3Ycz3bbcqO6O5k05kj14BuVnzk QE7U9gFDOH43Qd4rintyHyA2Qp9DF/i7JkNt7Od9KO4CfXkJJK6eZxz5HwCkJJPYxstR KGd82Uhqkkkq65pGgBX2UJrVBNXXwRx68DobM9OcTD1c3LfmdyeapwcUftxEJM54X8y2 GGJPWj8OLac9ugUJlOAnAKmmL7qLWj1DSYl8WlG0iEy6BG2XDcEhJyTwcK94khbqJvje 4Ymw== X-Gm-Message-State: AJIora/A4KhCh9odTR+Fleb97YG0m9fwSIGlvpB/E0unuRM9qjH/XkQ4 UXC6tujpiWXrceWATaSeiNXeh0dpMK4= X-Google-Smtp-Source: AGRyM1sTdQbj7QIQ49xadb6Yn8ZwM1BxYmn+FDHHDGJJ26V47pzTBaXpM6yfN2XMfH4QjPGtQA+AXCFvb0c= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6a00:27a6:b0:52a:e089:e777 with SMTP id bd38-20020a056a0027a600b0052ae089e777mr2824888pfb.53.1657582092309; Mon, 11 Jul 2022 16:28:12 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 11 Jul 2022 23:27:48 +0000 In-Reply-To: <20220711232750.1092012-1-seanjc@google.com> Message-Id: <20220711232750.1092012-2-seanjc@google.com> Mime-Version: 1.0 References: <20220711232750.1092012-1-seanjc@google.com> X-Mailer: git-send-email 2.37.0.144.g8ac04bfd2-goog Subject: [PATCH 1/3] KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com, Tetsuo Handa , Hou Wenlong Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Wait to mark the TSS as busy during LTR emulation until after all fault checks for the LTR have passed. Specifically, don't mark the TSS busy if the new TSS base is non-canonical. Opportunistically drop the one-off !seg_desc.PRESENT check for TR as the only reason for the early check was to avoid marking a !PRESENT TSS as busy, i.e. the common !PRESENT is now done before setting the busy bit. Fixes: e37a75a13cda ("KVM: x86: Emulator ignores LDTR/TR extended base on L= LDT/LTR") Reported-by: syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Tetsuo Handa Cc: Hou Wenlong Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky --- arch/x86/kvm/emulate.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 39ea9138224c..09e4b67b881f 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1699,16 +1699,6 @@ static int __load_segment_descriptor(struct x86_emul= ate_ctxt *ctxt, case VCPU_SREG_TR: if (seg_desc.s || (seg_desc.type !=3D 1 && seg_desc.type !=3D 9)) goto exception; - if (!seg_desc.p) { - err_vec =3D NP_VECTOR; - goto exception; - } - old_desc =3D seg_desc; - seg_desc.type |=3D 2; /* busy */ - ret =3D ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_des= c, - sizeof(seg_desc), &ctxt->exception); - if (ret !=3D X86EMUL_CONTINUE) - return ret; break; case VCPU_SREG_LDTR: if (seg_desc.s || seg_desc.type !=3D 2) @@ -1749,6 +1739,15 @@ static int __load_segment_descriptor(struct x86_emul= ate_ctxt *ctxt, ((u64)base3 << 32), ctxt)) return emulate_gp(ctxt, 0); } + + if (seg =3D=3D VCPU_SREG_TR) { + old_desc =3D seg_desc; + seg_desc.type |=3D 2; /* busy */ + ret =3D ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_des= c, + sizeof(seg_desc), &ctxt->exception); + if (ret !=3D X86EMUL_CONTINUE) + return ret; + } load: ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg); if (desc) --=20 2.37.0.144.g8ac04bfd2-goog From nobody Sat Apr 25 11:48:31 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 254A0C43334 for ; Mon, 11 Jul 2022 23:28:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231613AbiGKX2Y (ORCPT ); Mon, 11 Jul 2022 19:28:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231143AbiGKX2P (ORCPT ); Mon, 11 Jul 2022 19:28:15 -0400 Received: from mail-pl1-x649.google.com (mail-pl1-x649.google.com [IPv6:2607:f8b0:4864:20::649]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A56B78AB0F for ; Mon, 11 Jul 2022 16:28:14 -0700 (PDT) Received: by mail-pl1-x649.google.com with SMTP id n2-20020a170902e54200b0016c16832828so4541729plf.5 for ; Mon, 11 Jul 2022 16:28:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=reply-to:date:in-reply-to:message-id:mime-version:references :subject:from:to:cc; bh=gAFaZ4/4ERuw4bK9sHa39BcoOgob+bDhWwNvsNxoB+8=; b=auqC5Y/AOEJHYvT5qPXMTMJnka6P9ktH4abdMSWOrllMxo07I/fHOR1Euj69qajyqk sP4Rohst6VN5iI+6MzhVNTy9z93BaPKq0CCbbBID26OQ3N5W7at8LwMLp9r98UUMMU08 HSc1qtPQzk3lU6FnTI8MIkVef4+Ejj99QnhfJwaXxkYGdYxhoj3ap6hIox+Gs2WFa3zG hX2J1+srtP360eA/tgM09C1kWgrN5bhiB09PEpTOEelJbkm/5OFtZmNh4JAaP0XSDHb2 HpRlt2km/ZI/PR4pCjqN+iu+R36j5/ycovomW3LabExMuoXATs4jAZVTwVwq0gXACRDW tP/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:reply-to:date:in-reply-to:message-id :mime-version:references:subject:from:to:cc; bh=gAFaZ4/4ERuw4bK9sHa39BcoOgob+bDhWwNvsNxoB+8=; b=rrw0V0MZ3Hx/iHzAuPy9YT0EQPuKDUegChbDHdsOfB1Zw+afGSGLuZtL8tOv7XxUzW zhbzfDFv94WlwJ664d+/oqvEEbYb5jsJ54ULYGhJG4QxQQyOugzi1p09LZb/TeuYUifr 9yM1B2p6HKcn9d04DVXTWCsk/xOo5qCnenZRio13HV1FHMVn4pyXUs9Et/OOZm292frz XQSlih2h4gQsNE/4FjgTpHwuUucEzqhLmnV4+pzMr/WXviUmo8Y8RO7Sg6av5+i0kn11 unTfN7SlI64/BBAyV0szR2Fe4qDKhOXRTiG4CPvO5h7kuGNewfpGevPRdIwOKn57Mb7b bKfg== X-Gm-Message-State: AJIora/WZjfHFPO8JF1iwXNGi3jfWe5nHWXHhDkEMWZxYPC/Et0K4AFb gvUDpQHGVTH26SK9PmCse+wj0oqHjDg= X-Google-Smtp-Source: AGRyM1toxOQ6GZOX5C9iAC0TrcQrd+ZMPqz1VJ8qL2n+DNOsQyRGlX/ZARQ1rznHLWeOI9jnqRNUyzbhHDg= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:902:aa4b:b0:15f:b2c:73c7 with SMTP id c11-20020a170902aa4b00b0015f0b2c73c7mr21113989plr.164.1657582094045; Mon, 11 Jul 2022 16:28:14 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 11 Jul 2022 23:27:49 +0000 In-Reply-To: <20220711232750.1092012-1-seanjc@google.com> Message-Id: <20220711232750.1092012-3-seanjc@google.com> Mime-Version: 1.0 References: <20220711232750.1092012-1-seanjc@google.com> X-Mailer: git-send-email 2.37.0.144.g8ac04bfd2-goog Subject: [PATCH 2/3] KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com, Tetsuo Handa , Hou Wenlong Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When injecting a #GP on LLDT/LTR due to a non-canonical LDT/TSS base, set the error code to the selector. Intel SDM's says nothing about the #GP, but AMD's APM explicitly states that both LLDT and LTR set the error code to the selector, not zero. Note, a non-canonical memory operand on LLDT/LTR does generate a #GP(0), but the KVM code in question is specific to the base from the descriptor. Fixes: e37a75a13cda ("KVM: x86: Emulator ignores LDTR/TR extended base on L= LDT/LTR") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky --- arch/x86/kvm/emulate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 09e4b67b881f..bd9e9c5627d0 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1736,8 +1736,8 @@ static int __load_segment_descriptor(struct x86_emula= te_ctxt *ctxt, if (ret !=3D X86EMUL_CONTINUE) return ret; if (emul_is_noncanonical_address(get_desc_base(&seg_desc) | - ((u64)base3 << 32), ctxt)) - return emulate_gp(ctxt, 0); + ((u64)base3 << 32), ctxt)) + return emulate_gp(ctxt, err_code); } =20 if (seg =3D=3D VCPU_SREG_TR) { --=20 2.37.0.144.g8ac04bfd2-goog From nobody Sat Apr 25 11:48:31 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE855C43334 for ; Mon, 11 Jul 2022 23:28:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230283AbiGKX21 (ORCPT ); Mon, 11 Jul 2022 19:28:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231608AbiGKX2Y (ORCPT ); Mon, 11 Jul 2022 19:28:24 -0400 Received: from mail-pl1-x64a.google.com (mail-pl1-x64a.google.com [IPv6:2607:f8b0:4864:20::64a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 662C78AB1F for ; Mon, 11 Jul 2022 16:28:16 -0700 (PDT) Received: by mail-pl1-x64a.google.com with SMTP id c18-20020a170903235200b0016c37f6d48cso4016487plh.19 for ; Mon, 11 Jul 2022 16:28:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=reply-to:date:in-reply-to:message-id:mime-version:references :subject:from:to:cc; bh=l1YVI1jymWKPwtQYaErfNq6OCrckplvwfXfah/8A/rc=; b=SVmaSc+lEZoy1vyMnxQkmZX7Wb3FG6N+CBqp55C3XwrUZ33I51/VK8pLmMruirVuhl z+Mxx1RY+uXt8Nj17/lLRC/NMw6LZlLUmrjDVupkRHj52stwdyergUPLjOnoeiM1Bhw1 JyUdkak654zIqYhT1QsApidufgOzzlNHcW9pGtbuQKv6mU5pWGmx+dFYm19CXpOpZt9B wLFC4Ykc9rohW/Q4YHFEpyMN/CencJi4JOKSdSQkLa5C688mjx8lTKrwZSTGM3FSgAl6 1+Ppb7K6Dx4e2fPDH3isw/w9weHrROniS6nUzTv8XOEPRLqIXEZf7ES5nhlyAeckGmES BMZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:reply-to:date:in-reply-to:message-id :mime-version:references:subject:from:to:cc; bh=l1YVI1jymWKPwtQYaErfNq6OCrckplvwfXfah/8A/rc=; b=UBlMu8kNHx+Px4VqDdWdY/+IZIFdSxRqh1S4HlEWTK4zZF7227Wp8p9NPbP5DMNIHF 92GOsLPp4zz5m9PywosczkF0YyzsCahhrncwLHVxjVHOeKRTzmO0qn5SxAeOExVuqQf1 AHsULWU707NJ9T35ZzVX53TomdxIuhIGdxloBFm7HosSYhCJZEzncdZG9//Jp9HaTZOA +8iJY6BpV13gRM+LuREhVc4wVg15KOOg/6SC9CF9V6pwcHD402LftC2RNZevqxMpe7OK Ztlb85cAKWidWtr91X+LaLi6gxZAkqAZuUGPKuUX+RJ5X191HhLIP+lOjtpUCcd9SAIc sfuw== X-Gm-Message-State: AJIora+EcXn6okF5rKCay4pN9+z0QgHCLTDc/hI/eA1QvanbcfBHaU/r MEmrAhWLhnsxfOIdod/8h6f+eieBYvw= X-Google-Smtp-Source: AGRyM1v0IgBIRDYDSdN+eimreeKt668f69l4v8Y/nJf+NT6IYH6M7hCBXRbqo0rXXs5/PS7XjbVfSNZUSjU= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a17:90a:474c:b0:1ec:f898:d85b with SMTP id y12-20020a17090a474c00b001ecf898d85bmr895865pjg.11.1657582095847; Mon, 11 Jul 2022 16:28:15 -0700 (PDT) Reply-To: Sean Christopherson Date: Mon, 11 Jul 2022 23:27:50 +0000 In-Reply-To: <20220711232750.1092012-1-seanjc@google.com> Message-Id: <20220711232750.1092012-4-seanjc@google.com> Mime-Version: 1.0 References: <20220711232750.1092012-1-seanjc@google.com> X-Mailer: git-send-email 2.37.0.144.g8ac04bfd2-goog Subject: [PATCH 3/3] KVM: x86: WARN only once if KVM leaves a dangling userspace I/O request From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com, Tetsuo Handa , Hou Wenlong Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Change a WARN_ON() to separate WARN_ON_ONCE() if KVM has an outstanding PIO or MMIO request without an associated callback, i.e. if KVM queued a userspace I/O exit but didn't actually exit to userspace before moving on to something else. Warning on every KVM_RUN risks spamming the kernel if KVM gets into a bad state. Opportunistically split the WARNs so that it's easier to triage failures when a WARN fires. Deliberately do not use KVM_BUG_ON(), i.e. don't kill the VM. While the WARN is all but guaranteed to fire if and only if there's a KVM bug, a dangling I/O request does not present a danger to KVM (that flag is truly truly consumed only in a single emulator path), and any such bug is unlikely to be fatal to the VM (KVM essentially failed to do something it shouldn't have tried to do in the first place). In other words, note the bug, but let the VM keep running. Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky --- arch/x86/kvm/x86.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 567d13405445..50dc55996416 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -10847,8 +10847,10 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) r =3D cui(vcpu); if (r <=3D 0) goto out; - } else - WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed); + } else { + WARN_ON_ONCE(vcpu->arch.pio.count); + WARN_ON_ONCE(vcpu->mmio_needed); + } =20 if (kvm_run->immediate_exit) { r =3D -EINTR; --=20 2.37.0.144.g8ac04bfd2-goog