From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757263AbcH2MCY (ORCPT ); Mon, 29 Aug 2016 08:02:24 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37316 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756971AbcH2MCW (ORCPT ); Mon, 29 Aug 2016 08:02:22 -0400 Subject: Re: NULL-ptr deref in kvm_arch_vcpu_ioctl under AMD CPUs To: Dmitry Vyukov References: <800588f1-32d0-a4cc-821d-d31eef8921e7@redhat.com> Cc: =?UTF-8?Q?Robert_=c5=9awi=c4=99cki?= , LKML , Borislav Petkov From: Paolo Bonzini Message-ID: <7810f213-c6a5-b4b7-b95d-cd9dc2570641@redhat.com> Date: Mon, 29 Aug 2016 14:02:18 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Mon, 29 Aug 2016 12:02:22 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 19/08/2016 02:16, Dmitry Vyukov wrote: > > > This seems non-exploitable due to mmap_min_addr, so I guess it should > > > be treated just as a regular bug > > > > Probably fixed by commit 4c5ea0a9cd02 ("locking/static_key: Fix > > concurrent static_key_slow_inc()", 2016-06-21). There should be no > > outstanding syzkaller reports for KVM now! > > Thanks for the update. I will try to reenable kvm fuzzing on my > syzkaller instances. > Just to make sure, you mean all bugs prefixed with kvm: here, right? > https://github.com/google/syzkaller/wiki/Found-Bugs Yes. These are the relevant commits: b21629da120 kvm: x86: avoid warning on repeated KVM_SET_TSS_ADDR 83676e92389 KVM: x86: avoid vmalloc(0) in the KVM_SET_CPUID 78e546c824f KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number c622a3c21ed KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi f8c1b85b252 KVM: x86: avoid vmalloc(0) in the KVM_SET_CPUID d14bdb553f9 KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS 250715a6171 KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock 4c5ea0a9cd0 locking/static_key: Fix concurrent static_key_slow_inc() The last one is responsible for most if not all of the OOPses with threads. Paolo