• Paolo Bonzini's avatar
    KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number · 78e546c8
    Paolo Bonzini authored
    This cannot be returned by KVM_GET_VCPU_EVENTS, so it is okay to return
    EINVAL.  It causes a WARN from exception_type:
    
        WARNING: CPU: 3 PID: 16732 at arch/x86/kvm/x86.c:345 exception_type+0x49/0x50 [kvm]()
        CPU: 3 PID: 16732 Comm: a.out Tainted: G        W       4.4.6-300.fc23.x86_64 #1
        Hardware name: LENOVO 2325F51/2325F51, BIOS G2ET32WW (1.12 ) 05/30/2012
         0000000000000286 000000006308a48b ffff8800bec7fcf8 ffffffff813b542e
         0000000000000000 ffffffffa0966496 ffff8800bec7fd30 ffffffff810a40f2
         ffff8800552a8000 0000000000000000 00000000002c267c 0000000000000001
        Call Trace:
         [<ffffffff813b542e>] dump_stack+0x63/0x85
         [<ffffffff810a40f2>] warn_slowpath_common+0x82/0xc0
         [<ffffffff810a423a>] warn_slowpath_null+0x1a/0x20
         [<ffffffffa0924809>] exception_type+0x49/0x50 [kvm]
         [<ffffffffa0934622>] kvm_arch_vcpu_ioctl_run+0x10a2/0x14e0 [kvm]
         [<ffffffffa091c04d>] kvm_vcpu_ioctl+0x33d/0x620 [kvm]
         [<ffffffff81241248>] do_vfs_ioctl+0x298/0x480
         [<ffffffff812414a9>] SyS_ioctl+0x79/0x90
         [<ffffffff817a04ee>] entry_SYSCALL_64_fastpath+0x12/0x71
        ---[ end trace b1a0391266848f50 ]---
    
    Testcase (beautified/reduced from syzkaller output):
    
        #include <unistd.h>
        #include <sys/syscall.h>
        #include <string.h>
        #include <stdint.h>
        #include <fcntl.h>
        #include <sys/ioctl.h>
        #include <linux/kvm.h>
    
        long r[31];
    
        int main()
        {
            memset(r, -1, sizeof(r));
            r[2] = open("/dev/kvm", O_RDONLY);
            r[3] = ioctl(r[2], KVM_CREATE_VM, 0);
            r[7] = ioctl(r[3], KVM_CREATE_VCPU, 0);
    
            struct kvm_vcpu_events ve = {
                    .exception.injected = 1,
                    .exception.nr = 0xd4
            };
            r[27] = ioctl(r[7], KVM_SET_VCPU_EVENTS, &ve);
            r[30] = ioctl(r[7], KVM_RUN, 0);
            return 0;
        }
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
    78e546c8
x86.c 215 KB