linux-kernel - Re: [PATCH] KVM: X86: Fix loss of pending INIT due to race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 2 Aug 2017 06:43:08 +0800
From:   Wanpeng Li <kernellwp@...il.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        kvm <kvm@...r.kernel.org>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Wanpeng Li <wanpeng.li@...mail.com>
Subject: Re: [PATCH] KVM: X86: Fix loss of pending INIT due to race

2017-08-02 0:27 GMT+08:00 Paolo Bonzini <pbonzini@...hat.com>:
> On 30/07/2017 11:42, Wanpeng Li wrote:
>> From: Wanpeng Li <wanpeng.li@...mail.com>
>>
>> When SMP VM start, AP may lost INIT because of receiving INIT between
>> kvm_vcpu_ioctl_x86_get/set_vcpu_events.
>>
>>        vcpu 0                             vcpu 1
>>                                    kvm_vcpu_ioctl_x86_get_vcpu_events
>>                                      events->smi.latched_init = 0
>>   send INIT to vcpu1
>>     set vcpu1's pending_events
>>                                    kvm_vcpu_ioctl_x86_set_vcpu_events
>>                                       if (events->smi.latched_init == 0)
>>                                         clear INIT in pending_events
>>
>> This patch fixes it by not touching INIT pending if INIT is not latched
>> which in SMM and just restoring the latched INIT after SET_VCPU_EVENTS.
>>
>> Thanks Peng Hao for the report and original commit message.
>>
>> Reported-by: Peng Hao <peng.hao2@....com.cn>
>> Cc: Paolo Bonzini <pbonzini@...hat.com>
>> Cc: Radim Krčmář <rkrcmar@...hat.com>
>> Signed-off-by: Wanpeng Li <wanpeng.li@...mail.com>
>> ---
>>  arch/x86/kvm/x86.c | 8 ++------
>>  1 file changed, 2 insertions(+), 6 deletions(-)
>>
>> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
>> index 1a4c84d..eaca86d 100644
>> --- a/arch/x86/kvm/x86.c
>> +++ b/arch/x86/kvm/x86.c
>> @@ -3164,12 +3164,8 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
>>                       vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
>>               else
>>                       vcpu->arch.hflags &= ~HF_SMM_INSIDE_NMI_MASK;
>> -             if (lapic_in_kernel(vcpu)) {
>> -                     if (events->smi.latched_init)
>> -                             set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>> -                     else
>> -                             clear_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>> -             }
>> +             if (events->smi.latched_init && lapic_in_kernel(vcpu))
>> +                     set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>
> All this block:
>
>                 if (events->smi.smm_inside_nmi)
>                         vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
>                 else
>                         vcpu->arch.hflags &= ~HF_SMM_INSIDE_NMI_MASK;
>                 if (lapic_in_kernel(vcpu)) {
>                         if (events->smi.latched_init)
>                                 set_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>                         else
>                                 clear_bit(KVM_APIC_INIT, &vcpu->arch.apic->pending_events);
>                 }
>
> only applies if you're in SMM, so perhaps you can move it under
>
>         if (events->smi.smm)
>
> ?

Good point, I will do it in v2.

Regards,
Wanpeng Li

>
> Paolo
>
>>       }
>>
>>       kvm_make_request(KVM_REQ_EVENT, vcpu);
>>
>