KVM: x86: fix user triggerable warning in kvm_apic_accept_events() (28bf2888) · Commits · 戴 / test

If we already entered/are about to enter SMM, don't allow switching to INIT/SIPI_RECEIVED, otherwise the next call to kvm_apic_accept_events() will report a warning. Same applies if we are already in MP state INIT_RECEIVED and SMM is requested to be turned on. Refuse to set the VCPU events in this case. Fixes: ("KVM: x86: latch INITs while in system management mode") Cc: stable@vger.kernel.org # 4.2+ Reported-by:

Dmitry Vyukov <dvyukov@google.com> Signed-off-by:

David Hildenbrand <david@redhat.com> Signed-off-by:

Radim Krčmář <rkrcmar@redhat.com>

arch/x86/kvm/x86.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -3114,6 +3114,12 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
		(events->exception.nr > 31 \|\| events->exception.nr == NMI_VECTOR))
		return -EINVAL;

		/* INITs are latched while in SMM */
		if (events->flags & KVM_VCPUEVENT_VALID_SMM &&
		(events->smi.smm \|\| events->smi.pending) &&
		vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED)
		return -EINVAL;

		process_nmi(vcpu);
		vcpu->arch.exception.pending = events->exception.injected;
		vcpu->arch.exception.nr = events->exception.nr;
		@@ -7342,6 +7348,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
		mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
		return -EINVAL;

		/* INITs are latched while in SMM */
		if ((is_smm(vcpu) \|\| vcpu->arch.smi_pending) &&
		(mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED \|\|
		mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
		return -EINVAL;

		if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
		vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
		set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);

Admin message