From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752837AbcKRLLj (ORCPT ); Fri, 18 Nov 2016 06:11:39 -0500 Received: from mx1.redhat.com ([209.132.183.28]:46264 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751243AbcKRLLg (ORCPT ); Fri, 18 Nov 2016 06:11:36 -0500 Subject: Re: kvm: slab-out-of-bounds write in __apic_accept_irq To: Dmitry Vyukov , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , "x86@kernel.org" , KVM list , LKML , Steve Rutherford References: Cc: syzkaller From: Paolo Bonzini Message-ID: <0d7105a6-cb97-c452-372b-11db1ca6bae4@redhat.com> Date: Fri, 18 Nov 2016 12:11:30 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Fri, 18 Nov 2016 11:11:35 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Dmitry, we are working on some fixes, but at least I have a hard time following the reports. Please take a break until we push some of the patches for now-known failures. :) Thanks, Paolo On 18/11/2016 11:22, Dmitry Vyukov wrote: > Hello, > > The following program triggers slab-out-of-bounds write in __apic_accept_irq: > > https://gist.githubusercontent.com/dvyukov/6ef34f4a775091d664e18308aa0d5fa6/raw/bf12c7261fbb20cb0ff4318316f0fae7bd948eff/gistfile1.txt > > On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (4.9-rc5) > > ================================================================== > BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at > addr ffff880035d4918f > Write of size 1 by task a.out/27101 > CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > ffff880035c16ff0 ffffffff834c2a59 ffffffff00000001 1ffff10006b82d91 > ffffed0006b82d89 0000000041b58ab3 ffffffff895758d0 ffffffff834c276b > 0000000041b58ab3 0000000000000000 0000000000000002 1ffff10006b82d95 > Call Trace: > [< inline >] __dump_stack lib/dump_stack.c:15 > [] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51 > [] kasan_object_err+0x21/0x70 mm/kasan/report.c:159 > [< inline >] print_address_description mm/kasan/report.c:197 > [< inline >] kasan_report_error mm/kasan/report.c:286 > [] kasan_report+0x1eb/0x4c0 mm/kasan/report.c:306 > [] __asan_report_store1_noabort+0x1c/0x20 > mm/kasan/report.c:334 > [] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905 > [] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495 > [] kvm_irq_delivery_to_apic+0x732/0xc10 > arch/x86/kvm/irq_comm.c:86 > [] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360 > [] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222 > [< inline >] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235 > [] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670 > [< inline >] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668 > [] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999 > [] kvm_vm_ioctl+0x1fa/0x1a70 > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099 > [< inline >] vfs_ioctl fs/ioctl.c:43 > [] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679 > [< inline >] SYSC_ioctl fs/ioctl.c:694 > [] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685 > [] entry_SYSCALL_64_fastpath+0x23/0xc6 > arch/x86/entry/entry_64.S:209 > > Object at ffff880035d48bc0, in cache kmalloc-2048 size: 2048 > Allocated: > PID = 27101 > [ 291.279030] [] save_stack_trace+0x1b/0x20 > [ 291.279030] [] save_stack+0x43/0xd0 > [ 291.279030] [] kasan_kmalloc+0xad/0xe0 > [ 291.279030] [] kmem_cache_alloc_trace+0x12c/0x710 > [ 291.279030] [] kvm_ioapic_init+0xa0/0x680 > [ 291.279030] [] kvm_arch_vm_ioctl+0x11d7/0x23c0 > [ 291.279030] [] kvm_vm_ioctl+0x1fa/0x1a70 > [ 291.279030] [] do_vfs_ioctl+0x1c4/0x1630 > [ 291.279030] [] SyS_ioctl+0x94/0xc0 > [ 291.279030] [] entry_SYSCALL_64_fastpath+0x23/0xc6 > > Memory state around the buggy address: > ffff880035d49080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff880035d49100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >> ffff880035d49180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ^ > ffff880035d49200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff880035d49280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ================================================================== > Disabling lock debugging due to kernel taint > Disabled LAPIC found during irq injection >