linux-kernel - [PATCH 0/4] KVM: x86: Fix WFS vs. pending SMI WARN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250605195018.539901-1-seanjc@google.com>
Date: Thu,  5 Jun 2025 12:50:14 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzbot+c1cbaedc2613058d5194@...kaller.appspotmail.com
Subject: [PATCH 0/4] KVM: x86: Fix WFS vs. pending SMI WARN

Fix a user-triggerable WARN that syzkaller found by stuffing INIT_RECEIVED,
a.k.a. WFS, and then putting the vCPU into VMX Root Mode (post-VMXON).  Use
the same approach KVM uses for dealing with "impossible" emulation when
running a !URG guest, and simply wait until KVM_RUN to detect that the vCPU
has architecturally impossible state.

Sean Christopherson (4):
  KVM: x86: Drop pending_smi vs. INIT_RECEIVED check when setting
    MP_STATE
  KVM: x86: WARN and reject KVM_RUN if vCPU's MP_STATE is SIPI_RECEIVED
  KVM: x86: Move INIT_RECEIVED vs. INIT/SIPI blocked check to KVM_RUN
  KVM: x86: Refactor handling of SIPI_RECEIVED when setting MP_STATE

 arch/x86/kvm/x86.c | 49 ++++++++++++++++++++++++++++------------------
 1 file changed, 30 insertions(+), 19 deletions(-)


base-commit: 61374cc145f4a56377eaf87c7409a97ec7a34041
-- 
2.50.0.rc0.604.gd4ff7b7c86-goog