Re: kvm: slab-out-of-bounds write in __apic_accept_irq

[Paolo Bonzini <pbonzini@redhat.com>]

Dmitry, we are working on some fixes, but at least I have a hard time
following the reports.  Please take a break until we push some of the
patches for now-known failures. :)

Thanks,

Paolo

On 18/11/2016 11:22, Dmitry Vyukov wrote:
> Hello,
> 
> The following program triggers slab-out-of-bounds write in __apic_accept_irq:
> 
> https://gist.githubusercontent.com/dvyukov/6ef34f4a775091d664e18308aa0d5fa6/raw/bf12c7261fbb20cb0ff4318316f0fae7bd948eff/gistfile1.txt
> 
> On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (4.9-rc5)
> 
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at
> addr ffff880035d4918f
> Write of size 1 by task a.out/27101
> CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>  ffff880035c16ff0 ffffffff834c2a59 ffffffff00000001 1ffff10006b82d91
>  ffffed0006b82d89 0000000041b58ab3 ffffffff895758d0 ffffffff834c276b
>  0000000041b58ab3 0000000000000000 0000000000000002 1ffff10006b82d95
> Call Trace:
>  [<     inline     >] __dump_stack lib/dump_stack.c:15
>  [<ffffffff834c2a59>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51
>  [<ffffffff819f09f1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:159
>  [<     inline     >] print_address_description mm/kasan/report.c:197
>  [<     inline     >] kasan_report_error mm/kasan/report.c:286
>  [<ffffffff819f0cdb>] kasan_report+0x1eb/0x4c0 mm/kasan/report.c:306
>  [<ffffffff819f106c>] __asan_report_store1_noabort+0x1c/0x20
> mm/kasan/report.c:334
>  [<ffffffff8116fb53>] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905
>  [<ffffffff8117245e>] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495
>  [<ffffffff81184ea2>] kvm_irq_delivery_to_apic+0x732/0xc10
> arch/x86/kvm/irq_comm.c:86
>  [<ffffffff8118064d>] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360
>  [<ffffffff811817c5>] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222
>  [<     inline     >] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235
>  [<ffffffff81183653>] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670
>  [<     inline     >] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668
>  [<ffffffff810dfe18>] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999
>  [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099
>  [<     inline     >] vfs_ioctl fs/ioctl.c:43
>  [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679
>  [<     inline     >] SYSC_ioctl fs/ioctl.c:694
>  [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685
>  [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6
> arch/x86/entry/entry_64.S:209
> 
> Object at ffff880035d48bc0, in cache kmalloc-2048 size: 2048
> Allocated:
> PID = 27101
>  [  291.279030] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20
>  [  291.279030] [<ffffffff819efce3>] save_stack+0x43/0xd0
>  [  291.279030] [<ffffffff819effad>] kasan_kmalloc+0xad/0xe0
>  [  291.279030] [<ffffffff819ec32c>] kmem_cache_alloc_trace+0x12c/0x710
>  [  291.279030] [<ffffffff81182ca0>] kvm_ioapic_init+0xa0/0x680
>  [  291.279030] [<ffffffff810df5e7>] kvm_arch_vm_ioctl+0x11d7/0x23c0
>  [  291.279030] [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70
>  [  291.279030] [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630
>  [  291.279030] [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0
>  [  291.279030] [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6
> 
> Memory state around the buggy address:
>  ffff880035d49080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>  ffff880035d49100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ffff880035d49180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>                       ^
>  ffff880035d49200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>  ffff880035d49280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================
> Disabling lock debugging due to kernel taint
> Disabled LAPIC found during irq injection
>