linux-kernel - Re: include/linux/kvm_host.h:488 suspicious rcu_dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56001DF6.3000902@redhat.com>
Date:	Mon, 21 Sep 2015 17:10:46 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	Borislav Petkov <bp@...en8.de>
Cc:	kvm ML <kvm@...r.kernel.org>, lkml <linux-kernel@...r.kernel.org>,
	Xiao Guangrong <guangrong.xiao@...ux.intel.com>
Subject: Re: include/linux/kvm_host.h:488 suspicious rcu_dereference_check()
 usage!



On 20/09/2015 18:48, Borislav Petkov wrote:
> [26421.593927] ------ spte 0x3e5a22027 level 4.
> [26421.598228] ------ spte 0x38a00b027 level 3.
> [26421.602505] ------ spte 0x387334027 level 2.
> [26421.602506] ------ spte 0xffff0000000b8f67 level 1.
> [26421.602506] ------------[ cut here ]------------
> [26421.602530] WARNING: CPU: 2 PID: 17000 at arch/x86/kvm/mmu.c:3385 handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]()
> [26421.602550] Modules linked in: tun sha256_ssse3 sha256_generic drbg binfmt_misc ipv6 vfat fat fuse dm_crypt dm_mod kvm_amd kvm crc32_pclmul aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd fam15h_power amd64_edac_mod k10temp edac_core amdkfd amd_iommu_v2 radeon acpi_cpufreq
> [26421.602552] CPU: 2 PID: 17000 Comm: qemu-system-i38 Not tainted 4.3.0-rc1+ #1
> [26421.602553] Hardware name: To be filled by O.E.M. To be filled by O.E.M./M5A97 EVO R2.0, BIOS 1503 01/16/2013
> [26421.602555]  ffffffffa02fc7d2 ffff880386c0fb80 ffffffff812c8c2a 0000000000000000
> [26421.602556]  ffff880386c0fbb8 ffffffff81053e55 ffff880429ff8000 000000000000000f
> [26421.602558]  00000000000b8000 0000000000000000 00000000ffffffff ffff880386c0fbc8
> [26421.602558] Call Trace:
> [26421.602564]  [<ffffffff812c8c2a>] dump_stack+0x4e/0x84
> [26421.602566]  [<ffffffff81053e55>] warn_slowpath_common+0x95/0xe0
> [26421.602567]  [<ffffffff81053f5a>] warn_slowpath_null+0x1a/0x20
> [26421.602577]  [<ffffffffa02cf73a>] handle_mmio_page_fault.part.93+0x1a/0x20 [kvm]

Can you test this patch for this second call trace?

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index fb16a8ea3dee..10c281ec9a25 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3320,6 +3320,9 @@ walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
 		if (!is_shadow_present_pte(spte))
 			break;
 
+		if (leaf == 1 && is_mmio_spte(spte))
+			break;
+
 		reserved |= is_shadow_zero_bits_set(&vcpu->arch.mmu, spte,
 						    leaf);
 	}

Thanks,

Paolo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/