From nobody Fri Sep 5 20:17:18 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E06E0C32772 for ; Tue, 23 Aug 2022 11:07:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356983AbiHWLHk (ORCPT ); Tue, 23 Aug 2022 07:07:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1357179AbiHWLGQ (ORCPT ); Tue, 23 Aug 2022 07:06:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BC8BDB56C7; Tue, 23 Aug 2022 02:15:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5C9A761226; Tue, 23 Aug 2022 09:15:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4EF2CC433D7; Tue, 23 Aug 2022 09:15:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661246145; bh=2uJjk9l3Ah8Xx8u4fQm78ub0OlPkA9LIGQXELrh32Ik=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cigjePw1295XWoApAXEZi2ZSairpT9PwMOLBYlxCicf120vJpDTEEY/usZ8szqCpv dE6NS9hcY+3KRcKMRCvqpY+3KvQCLZoj2xMia1/sld3546H79G+ZLQA1kkcJc8Cux/ 53hm+FYXK7pRL1+WUKkgEZvrln2U/Yy5VuPAQR4I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com, Tetsuo Handa , Hou Wenlong , Sean Christopherson , Maxim Levitsky Subject: [PATCH 5.4 016/389] KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks Date: Tue, 23 Aug 2022 10:21:34 +0200 Message-Id: <20220823080116.375877327@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080115.331990024@linuxfoundation.org> References: <20220823080115.331990024@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson commit ec6e4d863258d4bfb36d48d5e3ef68140234d688 upstream. Wait to mark the TSS as busy during LTR emulation until after all fault checks for the LTR have passed. Specifically, don't mark the TSS busy if the new TSS base is non-canonical. Opportunistically drop the one-off !seg_desc.PRESENT check for TR as the only reason for the early check was to avoid marking a !PRESENT TSS as busy, i.e. the common !PRESENT is now done before setting the busy bit. Fixes: e37a75a13cda ("KVM: x86: Emulator ignores LDTR/TR extended base on L= LDT/LTR") Reported-by: syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Tetsuo Handa Cc: Hou Wenlong Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Link: https://lore.kernel.org/r/20220711232750.1092012-2-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/emulate.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1753,16 +1753,6 @@ static int __load_segment_descriptor(str case VCPU_SREG_TR: if (seg_desc.s || (seg_desc.type !=3D 1 && seg_desc.type !=3D 9)) goto exception; - if (!seg_desc.p) { - err_vec =3D NP_VECTOR; - goto exception; - } - old_desc =3D seg_desc; - seg_desc.type |=3D 2; /* busy */ - ret =3D ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_des= c, - sizeof(seg_desc), &ctxt->exception); - if (ret !=3D X86EMUL_CONTINUE) - return ret; break; case VCPU_SREG_LDTR: if (seg_desc.s || seg_desc.type !=3D 2) @@ -1803,6 +1793,15 @@ static int __load_segment_descriptor(str ((u64)base3 << 32), ctxt)) return emulate_gp(ctxt, 0); } + + if (seg =3D=3D VCPU_SREG_TR) { + old_desc =3D seg_desc; + seg_desc.type |=3D 2; /* busy */ + ret =3D ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_des= c, + sizeof(seg_desc), &ctxt->exception); + if (ret !=3D X86EMUL_CONTINUE) + return ret; + } load: ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg); if (desc)