[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CADrL8HXZed987KOehV7-OroPqm8tQZ0WH0MCpfDzaSs-g_2-ag@mail.gmail.com>
Date: Wed, 12 Feb 2025 16:08:15 -0800
From: James Houghton <jthoughton@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: syzbot+ac0bc3a70282b4d586cc@...kaller.appspotmail.com, bp@...en8.de,
dave.hansen@...ux.intel.com, hpa@...or.com, kvm@...r.kernel.org,
linux-kernel@...r.kernel.org, mingo@...hat.com, pbonzini@...hat.com,
syzkaller-bugs@...glegroups.com, tglx@...utronix.de, x86@...nel.org
Subject: Re: [syzbot] [kvm?] WARNING in vmx_handle_exit (2)
On Wed, Feb 12, 2025 at 2:50 PM Sean Christopherson <seanjc@...gle.com> wrote:
>
> On Wed, Feb 12, 2025, James Houghton wrote:
> > Here's what I think is going on (with the C repro anyway):
> >
> > 1. KVM_RUN a nested VM, and eventually we end up with
> > nested_run_pending=1.
> > 2. Exit KVM_RUN with EINTR (or any reason really, but I see EINTR in
> > repro attempts).
> > 3. KVM_SET_REGS to set rflags to 0x1ac585, which has X86_EFLAGS_VM,
> > flipping it and setting vmx->emulation_required = true.
> > 3. KVM_RUN again. vmx->emulation_required will stop KVM from clearing
> > nested_run_pending, and then we hit the
> > KVM_BUG_ON(nested_run_pending) in __vmx_handle_exit().
> >
> > So I guess the KVM_BUG_ON() is a little bit too conservative, but this
> > is nonsensical VMM behavior. So I'm not really sure what the best
> > solution is. Sean, any thoughts?
>
> Heh, deja vu. This is essentially the same thing that was fixed by commit
> fc4fad79fc3d ("KVM: VMX: Reject KVM_RUN if emulation is required with pending
> exception"), just with a different WARN.
>
> This should fix it. Checking nested_run_pending in handle_invalid_guest_state()
> is overkill, but it can't possibly do any harm, and the weirdness can be addressed
> with a comment.
Thanks Sean! This works, feel free to add:
Tested-by: James Houghton <jthoughton@...gle.com>
I understand this fix as "KVM cannot emulate a nested vm-enter, so if
emulation is required and we have a pending vm-enter, exit to
userspace." (This doesn't seem overkill to me... perhaps this
explanation is wrong.)
Powered by blists - more mailing lists