lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 030/101] KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
    Date
    From: Sean Christopherson <seanjc@google.com>

    commit ec6e4d863258d4bfb36d48d5e3ef68140234d688 upstream.

    Wait to mark the TSS as busy during LTR emulation until after all fault
    checks for the LTR have passed. Specifically, don't mark the TSS busy if
    the new TSS base is non-canonical.

    Opportunistically drop the one-off !seg_desc.PRESENT check for TR as the
    only reason for the early check was to avoid marking a !PRESENT TSS as
    busy, i.e. the common !PRESENT is now done before setting the busy bit.

    Fixes: e37a75a13cda ("KVM: x86: Emulator ignores LDTR/TR extended base on LLDT/LTR")
    Reported-by: syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com
    Cc: stable@vger.kernel.org
    Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
    Cc: Hou Wenlong <houwenlong.hwl@antgroup.com>
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
    Link: https://lore.kernel.org/r/20220711232750.1092012-2-seanjc@google.com
    Signed-off-by: Sean Christopherson <seanjc@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/x86/kvm/emulate.c | 19 +++++++++----------
    1 file changed, 9 insertions(+), 10 deletions(-)

    --- a/arch/x86/kvm/emulate.c
    +++ b/arch/x86/kvm/emulate.c
    @@ -1713,16 +1713,6 @@ static int __load_segment_descriptor(str
    case VCPU_SREG_TR:
    if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9))
    goto exception;
    - if (!seg_desc.p) {
    - err_vec = NP_VECTOR;
    - goto exception;
    - }
    - old_desc = seg_desc;
    - seg_desc.type |= 2; /* busy */
    - ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc,
    - sizeof(seg_desc), &ctxt->exception);
    - if (ret != X86EMUL_CONTINUE)
    - return ret;
    break;
    case VCPU_SREG_LDTR:
    if (seg_desc.s || seg_desc.type != 2)
    @@ -1763,6 +1753,15 @@ static int __load_segment_descriptor(str
    ((u64)base3 << 32)))
    return emulate_gp(ctxt, 0);
    }
    +
    + if (seg == VCPU_SREG_TR) {
    + old_desc = seg_desc;
    + seg_desc.type |= 2; /* busy */
    + ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc,
    + sizeof(seg_desc), &ctxt->exception);
    + if (ret != X86EMUL_CONTINUE)
    + return ret;
    + }
    load:
    ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg);
    if (desc)

    \
     
     \ /
      Last update: 2022-08-23 10:19    [W:4.308 / U:0.396 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site