On 25/03/2019 16:57, Waiman Long wrote:
> It was found that passing an invalid cpu number to pv_vcpu_is_preempted()
> might panic the kernel in a VM guest. For example,
>
> [ 2.531077] Oops: 0000 [#1] SMP PTI
> :
> [ 2.532545] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
> [ 2.533321] RIP: 0010:__raw_callee_save___kvm_vcpu_is_preempted+0x0/0x20
>
> To guard against this kind of kernel panic, check is added to
> pv_vcpu_is_preempted() to make sure that no invalid cpu number will
> be used.
>
> Signed-off-by: Waiman Long <longman@xxxxxxxxxx>
> ---
> arch/x86/include/asm/paravirt.h | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
> index c25c38a05c1c..4cfb465dcde4 100644
> --- a/arch/x86/include/asm/paravirt.h
> +++ b/arch/x86/include/asm/paravirt.h
> @@ -671,6 +671,12 @@ static __always_inline void pv_kick(int cpu)
>
> static __always_inline bool pv_vcpu_is_preempted(long cpu)
> {
> + /*
> + * Guard against invalid cpu number or the kernel might panic.
> + */
> + if (WARN_ON_ONCE((unsigned long)cpu >= nr_cpu_ids))
> + return false;
> +
> return PVOP_CALLEE1(bool, lock.vcpu_is_preempted, cpu);
> }
Can this really happen without being a programming error?
Basically you'd need to guard all percpu area accesses to foreign cpus
this way. Why is this one special?
Juergen
_______________________________________________
Virtualization mailing list
Virtualization@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
