From patchwork Fri Jan 6 01:39:42 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Wanpeng Li X-Patchwork-Id: 9499893 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 45A2B606E0 for ; Fri, 6 Jan 2017 01:50:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 37E5D27CFC for ; Fri, 6 Jan 2017 01:50:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2CB152842C; Fri, 6 Jan 2017 01:50:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8E7CB28420 for ; Fri, 6 Jan 2017 01:50:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753405AbdAFBur (ORCPT ); Thu, 5 Jan 2017 20:50:47 -0500 Received: from mail-pg0-f67.google.com ([74.125.83.67]:34229 "EHLO mail-pg0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753390AbdAFBun (ORCPT ); Thu, 5 Jan 2017 20:50:43 -0500 Received: by mail-pg0-f67.google.com with SMTP id b1so42340724pgc.1; Thu, 05 Jan 2017 17:50:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=6Bkq3GOsncGGtXYiWZnNbLpQELWSFUGx+nvMYKFg8dA=; b=qF4/gWMBTAsKdH+m3bla5hCbUZ0BYIwRlSDNTZFCDMx5kigzhOgS4MFrR/TqVNFXX5 sKpEnoOrUNcN6poA1EUZcO+uTULHNldKquUetpYn8U/6ROHBZ0Yy6Q2v9XkaLoKqydzQ PzljCdkRfA/nG2rhBABbp7pAnjK5ssgUDDL5erS50BcDgqT1ASHarq0HFRJZ845U14jA eZvHmgTUXfKP9NTKyh726cYDKW65oabOtWkf0wGygBiqDBi2Eo7noLRe3ghZsjRBy1rM O4yE2M6S854uTUSednm3PYdqtujqj49jRZZoozWrG3eEwVBH6nPrf2kcm1ELSILRScol ETug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=6Bkq3GOsncGGtXYiWZnNbLpQELWSFUGx+nvMYKFg8dA=; b=jOgPlemntYTjqSeA51ZQ7P7NloOCCjmiCpW5Z73fyi8YJGfQVasJSp/5NU5/lXhR4O /8/3Er8sPawb98WMDpgDza2Ue8JLJ3HQP++GEoj0qF8G9gBpaWkxMUXL6PkqiKbTeg/7 bFuhFLyMSY1RRUXuO1vLX2+GIjNWxiIdRpHofIFcUqlEGeQnkmCx63VYJ+PUVmtg++rY XuR2B9kVf+wl9IxzWcDkOvQljnXWgWoWxWELj0pJV4Rjr6vQ8mEC+PMy8FuEHmvaWMG5 pBBukp9ye86vVXZoCYK9vzvirCsngWhgsriZCg5f5gGb8tS64wRsqy2l0dDwCl4emnWo z77A== X-Gm-Message-State: AIkVDXI78+fIZlYrZk2hzOX9HPkfmsV2P7BMDOKsoyXc7gCU8ClePrMkFzx7yb+TdD6zNQ== X-Received: by 10.84.169.36 with SMTP id g33mr164595163plb.174.1483666793993; Thu, 05 Jan 2017 17:39:53 -0800 (PST) Received: from localhost ([203.205.141.123]) by smtp.gmail.com with ESMTPSA id y15sm157397187pgc.43.2017.01.05.17.39.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 05 Jan 2017 17:39:52 -0800 (PST) From: Wanpeng Li X-Google-Original-From: Wanpeng Li To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Dmitry Vyukov , Wanpeng Li , Alex Williamson Subject: [PATCH v2] KVM: eventfd: fix NULL deref irqbypass consumer Date: Thu, 5 Jan 2017 17:39:42 -0800 Message-Id: <1483666782-2693-1-git-send-email-wanpeng.li@hotmail.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Wanpeng Li Reported syzkaller: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass] PGD 0 Oops: 0002 [#1] SMP CPU: 1 PID: 125 Comm: kworker/1:1 Not tainted 4.9.0+ #1 Workqueue: kvm-irqfd-cleanup irqfd_shutdown [kvm] task: ffff9bbe0dfbb900 task.stack: ffffb61802014000 RIP: 0010:irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass] Call Trace: irqfd_shutdown+0x66/0xa0 [kvm] process_one_work+0x16b/0x480 worker_thread+0x4b/0x500 kthread+0x101/0x140 ? process_one_work+0x480/0x480 ? kthread_create_on_node+0x60/0x60 ret_from_fork+0x25/0x30 RIP: irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass] RSP: ffffb61802017e20 CR2: 0000000000000008 The syzkaller folks reported a NULL pointer dereference that due to unregister an consumer which fails registration before. The syzkaller creates two VMs w/ an equal eventfd occasionally. So the second VM fails to register an irqbypass consumer. It will make irqfd as inactive and queue an workqueue work to shutdown irqfd and unregister the irqbypass consumer when eventfd is closed. However, the second consumer has been initialized though it fails registration. So the token(same as the first VM's) is taken to unregister the consumer through the workqueue, the consumer of the first VM is found and unregistered, then NULL deref incurred in the path of deleting consumer from the consumers list. #include #include #include #include #include #include #include #include #include #include #include #include #include #include __thread int skip_segv; __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* uctx) { if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED)) _longjmp(segv_env, 1); exit(sig); } static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8) { return syscall(nr, a0, a1, a2, a3, a4, a5); } long r[28]; void* thr(void* arg) { switch ((long)arg) { case 0: r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0xd000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0); break; case 1: r[2] = syscall(__NR_open, "/dev/kvm", 0x40042ul, 0, 0, 0, 0, 0, 0); break; case 2: r[3] = execute_syscall(__NR_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0, 0, 0, 0); break; case 3: r[4] = execute_syscall(__NR_ioctl, r[3], 0xae41ul, 0x3fful, 0, 0, 0, 0, 0, 0); break; case 4: r[5] = execute_syscall(__NR_ioctl, r[4], 0xae9aul, 0, 0, 0, 0, 0, 0, 0); break; case 5: r[6] = execute_syscall(__NR_eventfd2, 0x8ul, 0x801ul, 0, 0, 0, 0, 0, 0, 0); break; case 6: NONFAILING(*(uint32_t*)0x2000c000 = r[6]); NONFAILING(*(uint32_t*)0x2000c004 = (uint32_t)0x98cd); NONFAILING(*(uint32_t*)0x2000c008 = (uint32_t)0x0); NONFAILING(*(uint32_t*)0x2000c00c = (uint32_t)0xffffffffffffffff); NONFAILING(*(uint8_t*)0x2000c010 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c011 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c012 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c013 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c014 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c015 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c016 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c017 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c018 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c019 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01a = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01b = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01c = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01d = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01e = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01f = (uint8_t)0x0); r[27] = execute_syscall(__NR_ioctl, r[3], 0x4020ae76ul, 0x2000c000ul, 0, 0, 0, 0, 0, 0); break; } return 0; } int main() { long i; pthread_t th[14]; install_segv_handler(); memset(r, -1, sizeof(r)); srand(getpid()); for (i = 0; i < 7; i++) { pthread_create(&th[i], 0, thr, (void*)i); usleep(10000); } for (i = 0; i < 7; i++) { pthread_create(&th[7 + i], 0, thr, (void*)i); if (rand() % 2) usleep(rand() % 10000); } usleep(100000); return 0; } This patch fixes it by making irq_bypass_register/unregister_consumer() looks for the consumer entry based on consumer pointer itself instead of token matching. Reported-by: Dmitry Vyukov Suggested-by: Alex Williamson Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Dmitry Vyukov Cc: Alex Williamson Signed-off-by: Wanpeng Li Acked-by: Paolo Bonzini --- v1 -> v2: * make irq_bypass_register/unregister_consumer() looks for the consumer entry based on consumer pointer itself instead of token matching virt/lib/irqbypass.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/virt/lib/irqbypass.c b/virt/lib/irqbypass.c index 52abac4..6d2fcd6 100644 --- a/virt/lib/irqbypass.c +++ b/virt/lib/irqbypass.c @@ -195,7 +195,7 @@ int irq_bypass_register_consumer(struct irq_bypass_consumer *consumer) mutex_lock(&lock); list_for_each_entry(tmp, &consumers, node) { - if (tmp->token == consumer->token) { + if (tmp->token == consumer->token || tmp == consumer) { mutex_unlock(&lock); module_put(THIS_MODULE); return -EBUSY; @@ -245,7 +245,7 @@ void irq_bypass_unregister_consumer(struct irq_bypass_consumer *consumer) mutex_lock(&lock); list_for_each_entry(tmp, &consumers, node) { - if (tmp->token != consumer->token) + if (tmp != consumer) continue; list_for_each_entry(producer, &producers, node) {