2016-07-06 21:26 GMT+08:00 Haozhong Zhang <haozhong.zhang@xxxxxxxxx>: > On 07/06/16 19:42, Wanpeng Li wrote: >> From: Wanpeng Li <wanpeng.li@xxxxxxxxxxx> >> >> BUG: unable to handle kernel NULL pointer dereference at (null) >> IP: [< (null)>] (null) >> PGD 0 >> Oops: 0010 [#1] SMP >> Call Trace: >> ? kvm_lapic_expired_hv_timer+0x47/0x90 [kvm] >> handle_preemption_timer+0xe/0x20 [kvm_intel] >> vmx_handle_exit+0x169/0x15a0 [kvm_intel] >> ? kvm_arch_vcpu_ioctl_run+0xd5d/0x19d0 [kvm] >> kvm_arch_vcpu_ioctl_run+0xdee/0x19d0 [kvm] >> ? kvm_arch_vcpu_ioctl_run+0xd5d/0x19d0 [kvm] >> ? vcpu_load+0x1c/0x60 [kvm] >> ? kvm_arch_vcpu_load+0x57/0x260 [kvm] >> kvm_vcpu_ioctl+0x2d3/0x7c0 [kvm] >> do_vfs_ioctl+0x96/0x6a0 >> ? __fget_light+0x2a/0x90 >> SyS_ioctl+0x79/0x90 >> do_syscall_64+0x68/0x180 >> entry_SYSCALL64_slow_path+0x25/0x25 >> Code: Bad RIP value. >> RIP [< (null)>] (null) >> RSP <ffff8800b5263c48> >> CR2: 0000000000000000 >> ---[ end trace 9c70c48b1a2bc66e ]--- >> >> This can be reproduced readily by preemption timer enabled on L0 and disabled >> on L1. >> >> Preemption timer for nested VMX is emulated by hrtimer which is started on L2 >> entry, stopped on L2 exit and evaluated via the check_nested_events hook. However, >> nested_vmx_exit_handled is always return true for preemption timer vmexit, then >> the L1 preemption timer vmexit is captured and be treated as a L2 preemption >> timer vmexit, incurr a nested vmexit dereference NULL pointer. >> >> This patch fix it by depending on check_nested_events to capture L2 preemption >> timer(emulated hrtimer) expire and nested vmexit. >> >> Cc: Paolo Bonzini <pbonzini@xxxxxxxxxx> >> Cc: Radim Krčmář <rkrcmar@xxxxxxxxxx> >> Cc: Yunhong Jiang <yunhong.jiang@xxxxxxxxx> >> Cc: Jan Kiszka <jan.kiszka@xxxxxxxxxxx> >> Cc: Haozhong Zhang <haozhong.zhang@xxxxxxxxx> >> Signed-off-by: Wanpeng Li <wanpeng.li@xxxxxxxxxxx> >> --- >> v2 -> v3: >> * update patch subject >> v1 -> v2: >> * fix typo in patch description >> >> arch/x86/kvm/vmx.c | 2 ++ >> 1 file changed, 2 insertions(+) >> >> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c >> index 85e2f0a..29c16a8 100644 >> --- a/arch/x86/kvm/vmx.c >> +++ b/arch/x86/kvm/vmx.c >> @@ -8041,6 +8041,8 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) >> return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES); >> case EXIT_REASON_PCOMMIT: >> return nested_cpu_has2(vmcs12, SECONDARY_EXEC_PCOMMIT); >> + case EXIT_REASON_PREEMPTION_TIMER: >> + return false; >> default: >> return true; >> } >> -- >> 1.9.1 >> > > This patch also fixed the crash of L1 Xen with L2 HVM guest. Xen does > not enable preemption timer for HVM guests, and will get panic if it > receives a preemption timer vmexit. > > Tested-by: Haozhong Zhang <haozhong.zhang@xxxxxxxxx> Thanks. :) Regards, Wanpeng Li -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
