linux-kernel - Re: [PATCH] KVM: x86: fix bogus warning about reserved bits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue, 22 Sep 2015 19:56:47 +0200
From:	Borislav Petkov <bp@...en8.de>
To:	Paolo Bonzini <pbonzini@...hat.com>
Cc:	linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Subject: Re: [PATCH] KVM: x86: fix bogus warning about reserved bits

On Tue, Sep 22, 2015 at 10:25:29AM +0200, Paolo Bonzini wrote:
> 29ecd6601904 ("KVM: x86: avoid uninitialized variable warning",
> 2015-09-06) introduced a not-so-subtle problem, which probably
> escaped review because it was not part of the patch context.

...

> diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
> index 69088a1ba509..3ce2b74c75dc 100644
> --- a/arch/x86/kvm/mmu.c
> +++ b/arch/x86/kvm/mmu.c
> @@ -3322,7 +3322,7 @@ walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
>  			break;
>  
>  		reserved |= is_shadow_zero_bits_set(&vcpu->arch.mmu, spte,
> -						    leaf);
> +						    iterator.level);
>  	}
>  
>  	walk_shadow_page_lockless_end(vcpu);
> -- 

No joy, I still see the splat at the end of this mail when starting a
kvm guest. Btw, this is what I have ontop of rc2+tip:

---
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 69088a1ba509..3ce2b74c75dc 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3322,7 +3322,7 @@ walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
 			break;
 
 		reserved |= is_shadow_zero_bits_set(&vcpu->arch.mmu, spte,
-						    leaf);
+						    iterator.level);
 	}
 
 	walk_shadow_page_lockless_end(vcpu);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index c0b9ff3e1aec..a44f8fed9be1 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7063,13 +7063,16 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
 						unsigned int id)
 {
 	struct kvm_vcpu *vcpu;
+	int idx;
 
 	if (check_tsc_unstable() && atomic_read(&kvm->online_vcpus) != 0)
 		printk_once(KERN_WARNING
 		"kvm: SMP vm created on host with unstable TSC; "
 		"guest TSC will not be reliable\n");
 
+	idx = srcu_read_lock(&kvm->srcu);
 	vcpu = kvm_x86_ops->vcpu_create(kvm, id);
+	srcu_read_unlock(&kvm->srcu, idx);
 
 	return vcpu;
 }
---

---
[   49.456533] walk_shadow_page_get_mmio_spte: detect reserved bits on spte, addr 0xb8000, dump hierarchy:
[   49.465945] ------ spte 0x416ed9027 level 4.
[   49.470221] ------ spte 0x416888027 level 3.
[   49.474494] ------ spte 0x41694f027 level 2.
[   49.474495] ------ spte 0xffff0000000b8f67 level 1.
[   49.474496] ------------[ cut here ]------------
[   49.474515] WARNING: CPU: 4 PID: 3540 at arch/x86/kvm/mmu.c:3385 handle_mmio_page_fault.part.57+0x1a/0x20 [kvm]()
[   49.474555] Modules linked in: tun sha256_ssse3 sha256_generic drbg binfmt_misc ipv6 vfat fat fuse dm_crypt dm_mod kvm_amd kvm crc32_pclmul aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd amd64_edac_mod fam15h_power k10temp edac_core amdkfd amd_iommu_v2 radeon acpi_cpufreq
[   49.474560] CPU: 4 PID: 3540 Comm: qemu-system-x86 Not tainted 4.3.0-rc2+ #2
[   49.474562] Hardware name: To be filled by O.E.M. To be filled by O.E.M./M5A97 EVO R2.0, BIOS 1503 01/16/2013
[   49.474569]  ffffffffa032f8b2 ffff880416a73b78 ffffffff812c758a 0000000000000000
[   49.474574]  ffff880416a73bb0 ffffffff810534c1 ffff8804171b0000 000000000000000f
[   49.474578]  00000000000b8000 0000000000000000 00000000ffffffff ffff880416a73bc0
[   49.474579] Call Trace:
[   49.474586]  [<ffffffff812c758a>] dump_stack+0x4e/0x84
[   49.474589]  [<ffffffff810534c1>] warn_slowpath_common+0x91/0xd0
[   49.474592]  [<ffffffff810535ba>] warn_slowpath_null+0x1a/0x20
[   49.474603]  [<ffffffffa0301a5a>] handle_mmio_page_fault.part.57+0x1a/0x20 [kvm]
[   49.474615]  [<ffffffffa0309350>] tdp_page_fault+0x2a0/0x2b0 [kvm]
[   49.474620]  [<ffffffff810a282d>] ? __lock_acquire+0x57d/0x17a0
[   49.474633]  [<ffffffffa03035a5>] kvm_mmu_page_fault+0x35/0x240 [kvm]
[   49.474637]  [<ffffffffa03886b8>] pf_interception+0x108/0x1d0 [kvm_amd]
[   49.474642]  [<ffffffffa038ad10>] handle_exit+0x150/0xa40 [kvm_amd]
[   49.474662]  [<ffffffffa02fa398>] ? kvm_arch_vcpu_ioctl_run+0x4c8/0x16f0 [kvm]
[   49.474674]  [<ffffffffa02fa403>] kvm_arch_vcpu_ioctl_run+0x533/0x16f0 [kvm]
[   49.474686]  [<ffffffffa02fa398>] ? kvm_arch_vcpu_ioctl_run+0x4c8/0x16f0 [kvm]
[   49.474690]  [<ffffffff816bd852>] ? mutex_lock_killable_nested+0x312/0x480
[   49.474700]  [<ffffffffa02e1979>] ? kvm_vcpu_ioctl+0x79/0x6f0 [kvm]
[   49.474705]  [<ffffffff8107e133>] ? preempt_count_sub+0xb3/0x110
[   49.474715]  [<ffffffffa02e1c3f>] kvm_vcpu_ioctl+0x33f/0x6f0 [kvm]
[   49.474719]  [<ffffffff811939d7>] do_vfs_ioctl+0x2d7/0x530
[   49.474722]  [<ffffffff8119f889>] ? __fget_light+0x29/0x90
[   49.474724]  [<ffffffff81193c7c>] SyS_ioctl+0x4c/0x90
[   49.474729]  [<ffffffff816c1a9b>] entry_SYSCALL_64_fastpath+0x16/0x73
[   49.474732] ---[ end trace 0e0be3552b84977c ]---


Thanks.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/