From patchwork Wed Jan 4 02:56:19 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Wanpeng Li X-Patchwork-Id: 9496015 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6CA47606B5 for ; Wed, 4 Jan 2017 02:56:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5EAAB2793B for ; Wed, 4 Jan 2017 02:56:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 517FE27AB2; Wed, 4 Jan 2017 02:56:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D1C66205AD for ; Wed, 4 Jan 2017 02:56:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761051AbdADC41 (ORCPT ); Tue, 3 Jan 2017 21:56:27 -0500 Received: from mail-pg0-f65.google.com ([74.125.83.65]:36671 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758161AbdADC4Z (ORCPT ); Tue, 3 Jan 2017 21:56:25 -0500 Received: by mail-pg0-f65.google.com with SMTP id n5so35427057pgh.3; Tue, 03 Jan 2017 18:56:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=tvlbaChdTxeFxNHH9bu/Cjmxax3QTIH7WdSFCMnJJkk=; b=S2eP2aHyUR5be8gFkOLy8Ua7YMzxO0WcTvJgie/G1V8HNMCR+h/FAzvgOZUQHhoUXM /eGEoymOB+DOlzMiCwKLkZFzi6j4nvZKG1wjJZi9eX5h8SOI+r0puZeA35BqmLXnqy4n qrCvpLHO7MI7iQGh2sQ2z+95JFdxb+NCgAEr5smsAXLFx80qfeKs1y9/2qPE57E4EoTk cilxr1f4cK19f/7+yzbbeH1wAMfJ7CdkGptSLDmlz++5nYIA8k97dx3zw19aZbmrfqsf tXXslWsq8kdgPU6i/lXV+2bx2rheRj+6S4XPUL4dUMPDJjp/O5Hnr2diolzUT2c0rqJu BNoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=tvlbaChdTxeFxNHH9bu/Cjmxax3QTIH7WdSFCMnJJkk=; b=L2UcLkhV0vVT276FEYrPBTQY7T+bbTyUqYjI0qs4/mCk60RvkYuB7jxbdzKOffXTEq b6TEck2pumgVO810nS2Tp3w9cNZL39pv+QZudYcng3nWsXb3LsinLFjGzkV/usyk9iSc 3hasu0QS3RktPsDrWD5+Rq43RenVJetwRe6GR92de79wK2OxNxZx0Yep8hIgg2ONeZlQ 9MipEcBU3EEMHvVf6QCojEQRAok2smY1Y5cUY9UWN5XolDddYRKUG/bnF01iDpM/nyVF HURNkvimFyM+RzQHYBuaTpQO4Kw38AtvbXqNYRrnNGDkn4IiC36pbIUjYPye8GpKkohp DMFg== X-Gm-Message-State: AIkVDXJnJew9lfnJzsny3gp3pBa3cfe+7Pd1j0CSrzw4MlHqCG+mWDWDYGmiyEtmNC/hWw== X-Received: by 10.99.106.200 with SMTP id f191mr120660190pgc.143.1483498584581; Tue, 03 Jan 2017 18:56:24 -0800 (PST) Received: from localhost ([203.205.141.123]) by smtp.gmail.com with ESMTPSA id w5sm142859192pfl.31.2017.01.03.18.56.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 03 Jan 2017 18:56:23 -0800 (PST) From: Wanpeng Li X-Google-Original-From: Wanpeng Li To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Dmitry Vyukov , Wanpeng Li Subject: [PATCH v2] KVM: x86: fix NULL deref in vcpu_scan_ioapic Date: Tue, 3 Jan 2017 18:56:19 -0800 Message-Id: <1483498579-34522-1-git-send-email-wanpeng.li@hotmail.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Wanpeng Li Reported by syzkaller: BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0 IP: _raw_spin_lock+0xc/0x30 PGD 3e28eb067 PUD 3f0ac6067 PMD 0 Oops: 0002 [#1] SMP CPU: 0 PID: 2431 Comm: test Tainted: G OE 4.10.0-rc1+ #3 Call Trace: ? kvm_ioapic_scan_entry+0x3e/0x110 [kvm] kvm_arch_vcpu_ioctl_run+0x10a8/0x15f0 [kvm] ? pick_next_task_fair+0xe1/0x4e0 ? kvm_arch_vcpu_load+0xea/0x260 [kvm] kvm_vcpu_ioctl+0x33a/0x600 [kvm] ? hrtimer_try_to_cancel+0x29/0x130 ? do_nanosleep+0x97/0xf0 do_vfs_ioctl+0xa1/0x5d0 ? __hrtimer_init+0x90/0x90 ? do_nanosleep+0x5b/0xf0 SyS_ioctl+0x79/0x90 do_syscall_64+0x6e/0x180 entry_SYSCALL64_slow_path+0x25/0x25 RIP: _raw_spin_lock+0xc/0x30 RSP: ffffa43688973cc0 The syzkaller folks reported a NULL pointer dereference that due to ENABLE_CAP doesn't fail without an irqchip, and synic is activated which results in a rescan ioapic request has been set although it should never been set for that vCPU. #include #include #include #include #include #include #include #include #include #include #ifndef KVM_CAP_HYPERV_SYNIC #define KVM_CAP_HYPERV_SYNIC 123 #endif void* thr(void* arg) { struct kvm_enable_cap cap; cap.flags = 0; cap.cap = KVM_CAP_HYPERV_SYNIC; ioctl((long)arg, KVM_ENABLE_CAP, &cap); return 0; } int main() { void *host_mem = mmap(0, 0x1000, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); int kvmfd = open("/dev/kvm", 0); int vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0); struct kvm_userspace_memory_region memreg; memreg.slot = 0; memreg.flags = 0; memreg.guest_phys_addr = 0; memreg.memory_size = 0x1000; memreg.userspace_addr = (unsigned long)host_mem; memcpy(host_mem, "\x1a\xb5\x00\x04\x65\x26\x64\x26\xf0\x82\xaa\x00" "\x02\x00\x3e\x75\x64\xf3\xf3\xf0\x18\x35\x66\xb9" "\x99\x00\x00\x40\x46\xb8\xc0\x40\x00\x00\x66\xba" "\x00\x00\x00\x00\x0f\x30\x0f\xfc\xda\xdb\xca\x36" "\x26\x3e\x67\x3e\x67\xcf\x66\xb9\x4a\x0a\x00\x00" "\x0f\x32\x2e\x26\x65\x0f\x0f\x01\xa0", 69); ioctl(vmfd, KVM_SET_USER_MEMORY_REGION, &memreg); int cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0); struct kvm_sregs sregs; ioctl(cpufd, KVM_GET_SREGS, &sregs); sregs.cr0 = 0; sregs.cr4 = 0; sregs.efer = 0; sregs.cs.selector = 0; sregs.cs.base = 0; ioctl(cpufd, KVM_SET_SREGS, &sregs); struct kvm_regs regs; memset(®s, 0, sizeof(regs)); regs.rflags = 2; ioctl(cpufd, KVM_SET_REGS, ®s); ioctl(vmfd, KVM_CREATE_IRQCHIP, 0); pthread_t th; pthread_create(&th, 0, thr, (void*)(long)cpufd); usleep(rand() % 10000); ioctl(cpufd, KVM_RUN, 0); pthread_join(th, 0); return 0; } This patch fix it by failing ENABLE_CAP if without an irqchip. Reported-by: Dmitry Vyukov Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Dmitry Vyukov Signed-off-by: Wanpeng Li Reviewed-by: David Hildenbrand --- v1 -> v2: * fail ENABLE_CAP if without an irqchip arch/x86/kvm/x86.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 5f6e288..2ada44a 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -3345,6 +3345,8 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu, switch (cap->cap) { case KVM_CAP_HYPERV_SYNIC: + if (!irqchip_in_kernel(vcpu->kvm)) + return -EINVAL; return kvm_hv_activate_synic(vcpu); default: return -EINVAL;