Fix a couple of bugs related to handling triple faults, namely KVM
injecting a triple fault into an L2 that hasn't run yet, or KVM
combining #DB/#BP from KVM_SET_GUEST_DEBUG with existing exceptions
causing a triple fault (or #DF).
Either of these bugs can result in a triple fault being injected with
nested_run_pending=1, leading to triggering the warning in
__nested_vmx_vmexit().
The following syzkaller reproducer should trigger it (although it was
manually modified and I cannot test it directly):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000fe9000/0x3000)=nil, r3, 0x1000003, 0x13, r2, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x41, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000006c0)=@x86={0xf7, 0x8, 0x29, 0x0, 0x5, 0x67, 0x1, 0x9, 0x9, 0xbd, 0x6, 0xff, 0x0, 0x5, 0x4, 0x3, 0x7, 0x7, 0xc, '\x00', 0x7, 0xb})
ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000100)={0x1d0002, 0x0, {[0x8, 0x0, 0x7, 0x2, 0x87c8, 0x5, 0x5, 0x6]}})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
Yosry Ahmed (3):
KVM: x86: Move nested_run_pending to kvm_vcpu_arch
KVM: x86: Do not inject triple faults into an L2 with a pending run
KVM: x86: Check for injected exceptions before queuing a debug
exception
arch/x86/include/asm/kvm_host.h | 3 +++
arch/x86/kvm/svm/nested.c | 14 +++++-----
arch/x86/kvm/svm/svm.c | 12 ++++-----
arch/x86/kvm/svm/svm.h | 4 ---
arch/x86/kvm/vmx/nested.c | 46 ++++++++++++++++-----------------
arch/x86/kvm/vmx/vmx.c | 16 ++++++------
arch/x86/kvm/vmx/vmx.h | 3 ---
arch/x86/kvm/x86.c | 15 ++++++++++-
8 files changed, 61 insertions(+), 52 deletions(-)
base-commit: 183bb0ce8c77b0fd1fb25874112bc8751a461e49
--
2.53.0.473.g4a7958ca14-goog