Re: UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid

2021-01-13 Thread Sean Christopherson
On Wed, Jan 13, 2021, Paolo Bonzini wrote: > On 12/01/21 17:53, Sean Christopherson wrote: > > And, masking bits 7:6 is architecturally wrong. Both the SDM and APM state > > that > > bits 7:0 contain the number of PA bits. > > They cannot be higher than 52, Drat, I was going to argue that it

Re: UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid

2021-01-13 Thread Paolo Bonzini
On 12/01/21 17:53, Sean Christopherson wrote: On Tue, Jan 12, 2021, Paolo Bonzini wrote: On 12/01/21 00:01, Sean Christopherson wrote: Perhaps cpuid_query_maxphyaddr() should just look at the low 5 bits of CPUID.8008H:EAX? The low 6 bits I guess---yes, that would make sense and it would

Re: UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid

2021-01-12 Thread Sean Christopherson
On Tue, Jan 12, 2021, Paolo Bonzini wrote: > On 12/01/21 00:01, Sean Christopherson wrote: > > > Perhaps cpuid_query_maxphyaddr() should just look at the low 5 bits of > > > CPUID.8008H:EAX? > > The low 6 bits I guess---yes, that would make sense and it would have also > fixed the bug. No,

Re: UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid

2021-01-12 Thread Paolo Bonzini
On 12/01/21 00:01, Sean Christopherson wrote: Perhaps cpuid_query_maxphyaddr() should just look at the low 5 bits of CPUID.8008H:EAX? The low 6 bits I guess---yes, that would make sense and it would have also fixed the bug. (Nevertheless it's a good idea to make rsvd_bits more robust as

Re: UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid

2021-01-11 Thread Jim Mattson
It looks like userspace can possibly induce this by providing guest CPUID information with a "physical address width" of 64 in leaf 0x8008. Perhaps cpuid_query_maxphyaddr() should just look at the low 5 bits of CPUID.8008H:EAX? Better would be to return an error for out-of-range values,

Re: UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid

2021-01-11 Thread Sean Christopherson
On Mon, Jan 11, 2021, Jim Mattson wrote: > It looks like userspace can possibly induce this by providing guest > CPUID information with a "physical address width" of 64 in leaf > 0x8008. It was actually the opposite, where userspace provides '0' and caused '63 - 0 + 1' to overflow. KVM

UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid

2020-12-22 Thread syzbot
Hello, syzbot found the following issue on: HEAD commit:5e60366d Merge tag 'fallthrough-fixes-clang-5.11-rc1' of g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=11c7046b50 kernel config: https://syzkaller.appspot.com/x/.config?x=db720fe37a6a41d8