Re: [PATCH 1/2] KVM: vmx/pmu: Fix dummy check if lbr_desc->event is created
From: Sean Christopherson
Date: Fri Feb 26 2021 - 17:48:07 EST
On Wed, Feb 24, 2021, Xu, Like wrote:
>
On 2021年2月24日 1:15, Sean Christopherson wrote:
>
> On Tue, Feb 23, 2021, Like Xu wrote:
>
> > If lbr_desc->event is successfully created, the intel_pmu_create_
>
> > guest_lbr_event() will return 0, otherwise it will return -ENOENT,
>
> > and then jump to LBR msrs dummy handling.
>
> >
>
> > Fixes: 1b5ac3226a1a ("KVM: vmx/pmu: Pass-through LBR msrs when the guest LBR event is ACTIVE")
>
> > Signed-off-by: Like Xu <like.xu@xxxxxxxxxxxxxxx>
>
> > ---
>
> > arch/x86/kvm/vmx/pmu_intel.c | 2 +-
>
> > 1 file changed, 1 insertion(+), 1 deletion(-)
>
> >
>
> > diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
>
> > index d1df618cb7de..d6a5fe19ff09 100644
>
> > --- a/arch/x86/kvm/vmx/pmu_intel.c
>
> > +++ b/arch/x86/kvm/vmx/pmu_intel.c
>
> > @@ -320,7 +320,7 @@ static bool intel_pmu_handle_lbr_msrs_access(struct kvm_vcpu *vcpu,
>
> > if (!intel_pmu_is_valid_lbr_msr(vcpu, index))
>
> > return false;
>
> > - if (!lbr_desc->event && !intel_pmu_create_guest_lbr_event(vcpu))
>
> > + if (!lbr_desc->event && intel_pmu_create_guest_lbr_event(vcpu))
>
> > goto dummy;
...
>
> AFAICT, event contention would lead to a #GP crash in the host due to
>
> lbr_desc->event being dereferenced, no?
>
>
a #GP crash in the host ？Can you share more understanding about it ?
The original code is will dereference a null lbr_desc->event if
intel_pmu_create_guest_lbr_event() fails.
if (!lbr_desc->event && intel_pmu_create_guest_lbr_event(vcpu)) <- falls through
goto dummy;
/*
* Disable irq to ensure the LBR feature doesn't get reclaimed by the
* host at the time the value is read from the msr, and this avoids the
* host LBR value to be leaked to the guest. If LBR has been reclaimed,
* return 0 on guest reads.
*/
local_irq_disable();
if (lbr_desc->event->state == PERF_EVENT_STATE_ACTIVE) { <--------- kaboom
if (read)
rdmsrl(index, msr_info->data);
else
wrmsrl(index, msr_info->data);
__set_bit(INTEL_PMC_IDX_FIXED_VLBR, vcpu_to_pmu(vcpu)->pmc_in_use);
local_irq_enable();
return true;
}