Sean Christopherson 228f45b39f Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" ... commit e7177339d7b5f9594b316842122b5fda9513d5e2 upstream. Revert a misguided illegal GPA check when "translating" a non-nested GPA. The check is woefully incomplete as it does not fill in @exception as expected by all callers, which leads to KVM attempting to inject a bogus exception, potentially exposing kernel stack information in the process. WARNING: CPU: 0 PID: 8469 at arch/x86/kvm/x86.c:525 exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525 CPU: 1 PID: 8469 Comm: syz-executor531 Not tainted 5.14.0-rc7-syzkaller #0 RIP: 0010:exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525 Call Trace: x86_emulate_instruction+0xef6/0x1460 arch/x86/kvm/x86.c:7853 kvm_mmu_page_fault+0x2f0/0x1810 arch/x86/kvm/mmu/mmu.c:5199 handle_ept_misconfig+0xdf/0x3e0 arch/x86/kvm/vmx/vmx.c:5336 __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6021 [inline] vmx_handle_exit+0x336/0x1800 arch/x86/kvm/vmx/vmx.c:6038 vcpu_enter_guest+0x2a1c/0x4430 arch/x86/kvm/x86.c:9712 vcpu_run arch/x86/kvm/x86.c:9779 [inline] kvm_arch_vcpu_ioctl_run+0x47d/0x1b20 arch/x86/kvm/x86.c:10010 kvm_vcpu_ioctl+0x49e/0xe50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3652 The bug has escaped notice because practically speaking the GPA check is useless. The GPA check in question only comes into play when KVM is walking guest page tables (or "translating" CR3), and KVM already handles illegal GPA checks by setting reserved bits in rsvd_bits_mask for each PxE, or in the case of CR3 for loading PTDPTRs, manually checks for an illegal CR3. This particular failure doesn't hit the existing reserved bits checks because syzbot sets guest.MAXPHYADDR=1, and IA32 architecture simply doesn't allow for such an absurd MAXPHYADDR, e.g. 32-bit paging doesn't define any reserved PA bits checks, which KVM emulates by only incorporating the reserved PA bits into the "high" bits, i.e. bits 63:32. Simply remove the bogus check. There is zero meaningful value and no architectural justification for supporting guest.MAXPHYADDR < 32, and properly filling the exception would introduce non-trivial complexity. This reverts commit ec7771ab47. Fixes: ec7771ab47 ("KVM: x86: mmu: Add guest physical address check in translate_gpa()") Cc: stable@vger.kernel.org Reported-by: syzbot+200c08e88ae818f849ce@syzkaller.appspotmail.com Signed-off-by: Sean Christopherson <seanjc@google.com> Message-Id: <20210831164224.1119728-2-seanjc@google.com> Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-07-05 19:13:47 +02:00
..
mmu_audit.c	KVM: x86/mmu: Rename page_header() to to_shadow_page()	2020-07-08 16:21:55 -04:00
mmu_internal.h	kvm: x86/mmu: NX largepage recovery for TDP MMU	2020-10-23 03:42:16 -04:00
mmu.c	Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()"	2024-07-05 19:13:47 +02:00
mmutrace.h	kvm: x86/mmu: Add TDP MMU PF handler	2020-10-23 03:42:04 -04:00
page_track.c	kvm: mmu: page_track: Fix RCU list API usage	2020-08-24 18:36:23 -07:00
paging_tmpl.h	KVM: x86/mmu: Do not apply HPA (memory encryption) mask to GPAs	2021-07-20 16:05:36 +02:00
paging.h	KVM: x86/mmu: Do not apply HPA (memory encryption) mask to GPAs	2021-07-20 16:05:36 +02:00
spte.c	KVM: mmu: Fix SPTE encoding of MMIO generation upper half	2020-12-11 19:18:43 -05:00
spte.h	KVM: x86/mmu: Do not apply HPA (memory encryption) mask to GPAs	2021-07-20 16:05:36 +02:00
tdp_iter.c	KVM: x86/mmu: Ensure forward progress when yielding in TDP MMU iter	2021-04-14 08:42:04 +02:00
tdp_iter.h	KVM: x86/mmu: Ensure forward progress when yielding in TDP MMU iter	2021-04-14 08:42:04 +02:00
tdp_mmu.c	KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level()	2021-07-14 16:56:08 +02:00
tdp_mmu.h	KVM: x86/mmu: Don't allow TDP MMU to yield when recovering NX pages	2021-04-14 08:42:04 +02:00