linux-kernel - Re: [PATCH 0/4] KVM: x86: Fix WFS vs. pending SMI WARN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <175079323951.521058.7931806146009208206.b4-ty@google.com>
Date: Tue, 24 Jun 2025 12:38:30 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Sean Christopherson <seanjc@...gle.com>, Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org, 
	syzbot+c1cbaedc2613058d5194@...kaller.appspotmail.com
Subject: Re: [PATCH 0/4] KVM: x86: Fix WFS vs. pending SMI WARN

On Thu, 05 Jun 2025 12:50:14 -0700, Sean Christopherson wrote:
> Fix a user-triggerable WARN that syzkaller found by stuffing INIT_RECEIVED,
> a.k.a. WFS, and then putting the vCPU into VMX Root Mode (post-VMXON).  Use
> the same approach KVM uses for dealing with "impossible" emulation when
> running a !URG guest, and simply wait until KVM_RUN to detect that the vCPU
> has architecturally impossible state.
> 
> Sean Christopherson (4):
>   KVM: x86: Drop pending_smi vs. INIT_RECEIVED check when setting
>     MP_STATE
>   KVM: x86: WARN and reject KVM_RUN if vCPU's MP_STATE is SIPI_RECEIVED
>   KVM: x86: Move INIT_RECEIVED vs. INIT/SIPI blocked check to KVM_RUN
>   KVM: x86: Refactor handling of SIPI_RECEIVED when setting MP_STATE
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/4] KVM: x86: Drop pending_smi vs. INIT_RECEIVED check when setting MP_STATE
      https://github.com/kvm-x86/linux/commit/c4a37acc5193
[2/4] KVM: x86: WARN and reject KVM_RUN if vCPU's MP_STATE is SIPI_RECEIVED
      https://github.com/kvm-x86/linux/commit/16777ebded41
[3/4] KVM: x86: Move INIT_RECEIVED vs. INIT/SIPI blocked check to KVM_RUN
      https://github.com/kvm-x86/linux/commit/0fe3e8d804fd
[4/4] KVM: x86: Refactor handling of SIPI_RECEIVED when setting MP_STATE
      https://github.com/kvm-x86/linux/commit/58c81bc1e71d

--
https://github.com/kvm-x86/kvm-unit-tests/tree/next