From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1945970AbcHRL6X (ORCPT ); Thu, 18 Aug 2016 07:58:23 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47608 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753534AbcHRL6V (ORCPT ); Thu, 18 Aug 2016 07:58:21 -0400 Subject: Re: NULL-ptr deref in kvm_arch_vcpu_ioctl under AMD CPUs To: =?UTF-8?Q?Robert_=c5=9awi=c4=99cki?= , LKML References: Cc: Dmitry Vyukov , Borislav Petkov From: Paolo Bonzini Message-ID: <800588f1-32d0-a4cc-821d-d31eef8921e7@redhat.com> Date: Thu, 18 Aug 2016 13:58:09 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Thu, 18 Aug 2016 11:58:13 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 19/02/2016 15:06, Robert Święcki wrote: > Hi, > > This seems non-exploitable due to mmap_min_addr, so I guess it should > be treated just as a regular bug Probably fixed by commit 4c5ea0a9cd02 ("locking/static_key: Fix concurrent static_key_slow_inc()", 2016-06-21). There should be no outstanding syzkaller reports for KVM now! Paolo > Tested with 4.5-rc4 and with 4.4 under Opteron 6272 and FX-8320 > > [167193.153283] BUG: unable to handle kernel NULL pointer dereference > at 00000000000000f0 > [167193.153372] IP: [] kvm_arch_vcpu_ioctl+0x417/0x1120 [kvm] > [167193.153453] PGD fca0067 PUD 79907067 PMD 0 > [167193.153503] Oops: 0000 [#1] SMP > [167193.153571] Modules linked in: binfmt_misc nls_utf8 btrfs xor > raid6_pq ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs libcrc32c > kvm_amd amd64_edac_mod input_leds joydev kvm snd_pcm snd_timer > edac_mce_amd edac_core snd i2c_piix4 irqbypass fam15h_power > tpm_infineon shpchp k10temp crct10dif_pclmul crc32_pclmul aesni_intel > psmouse evbug soundcore aes_x86_64 mac_hid lrw 8250_fintek gf128mul > serio_raw glue_helper pcspkr ablk_helper cryptd ipmi_ssif > ipmi_watchdog ipmi_si ipmi_poweroff ipmi_devintf ipmi_msghandler > autofs4 pata_acpi hid_generic usbkbd usbmouse usbhid hid igb > i2c_algo_bit dca ahci ptp pata_atiixp libahci pps_core fjes > [167193.154119] CPU: 3 PID: 22154 Comm: z Not tainted 4.4.0-4-generic #19-Ubuntu > [167193.154173] Hardware name: HP ProLiant DL165 G7, BIOS O37 02/02/2012 > [167193.154224] task: ffff8801fe899b80 ti: ffff88005ff30000 task.ti: > ffff88005ff30000 > [167193.154304] RIP: 0010:[] [] > kvm_arch_vcpu_ioctl+0x417/0x1120 [kvm] > [167193.154397] RSP: 0018:ffff88005ff33d28 EFLAGS: 00010246 > [167193.154445] RAX: 0000000000000000 RBX: ffffffffffffffea RCX: > 0000000000000176 > [167193.154523] RDX: 0000000000000000 RSI: 000000008040ae9f RDI: > ffff880075eebe80 > [167193.154601] RBP: ffff88005ff33e00 R08: 0000000000000000 R09: > 0000000000000000 > [167193.154684] R10: 0000000000000000 R11: 0000000000000212 R12: > 0000000020010fef > [167193.154785] R13: 0000000000000000 R14: ffff880075eebe80 R15: > 0000000000000000 > [167193.154864] FS: 00007f00c9d7b700(0000) GS:ffff88007dcc0000(0000) > knlGS:0000000000000000 > [167193.154945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [167193.154994] CR2: 00000000000000f0 CR3: 0000000078982000 CR4: > 00000000000406e0 > [167193.155077] Stack: > [167193.155112] ffffffff810e9ca1 0000000000000086 0000000050045e40 > 0000000000000003 > [167193.155199] ffff880000105200 0000000000000000 0000000000000000 > ffff880000000000 > [167193.155286] ffff88005f000000 ffffffffc0249a63 0000000075eebe80 > 0000000050045e40 > [167193.155373] Call Trace: > [167193.155417] [] ? add_timer_on+0xf1/0x160 > [167193.155469] [] ? svm_vcpu_load+0x83/0x110 [kvm_amd] > [167193.155536] [] ? kvm_arch_vcpu_load+0x5a/0x220 [kvm] > [167193.155600] [] kvm_vcpu_ioctl+0xe7/0x5f0 [kvm] > [167193.155653] [] ? anon_inode_getfd+0x52/0x80 > [167193.155713] [] ? kvm_dev_ioctl+0x140/0x4a0 [kvm] > [167193.155766] [] do_vfs_ioctl+0x298/0x480 > [167193.155815] [] ? putname+0x54/0x60 > [167193.155863] [] ? do_sys_open+0x1bf/0x280 > [167193.155913] [] SyS_ioctl+0x79/0x90 > [167193.155984] [] entry_SYSCALL_64_fastpath+0x16/0x71 > [167193.156035] Code: e0 01 83 e2 01 88 95 68 ff ff ff 41 0f b6 96 39 > 32 00 00 88 85 6a ff ff ff 88 95 69 ff ff ff 0f 1f 44 00 00 49 8b 86 > a0 02 00 00 <48> 8b 80 f0 00 00 00 83 e0 01 88 85 6b ff ff ff c7 85 64 > ff ff > [167193.156326] RIP [] kvm_arch_vcpu_ioctl+0x417/0x1120 [kvm] > [167193.156391] RSP > [167193.156432] CR2: 00000000000000f0 > [167193.156840] ---[ end trace 3ff15297044194ff ]--- > > > ==== > // autogenerated by syzkaller (http://github.com/google/syzkaller) > #include > #include > #include > #include > #include > > long r[6]; > > int main() > { > memset(r, -1, sizeof(r)); > r[0] = syscall(SYS_mmap, 0x20000000ul, 0x13000ul, 0x3ul, 0x32ul, > 0xfffffffffffffffful, 0x0ul); > memcpy((void*)0x2000eedb, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8); > r[2] = syscall(SYS_open, 0x2000eedbul, 0x0ul, 0x100ul, 0, 0, 0); > r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0); > r[4] = syscall(SYS_ioctl, r[3], 0xae41ul, 0x7ul, 0, 0, 0); > r[5] = syscall(SYS_ioctl, r[4], 0x8040ae9ful, 0x20010feful, 0, 0, 0); > return 0; > } > ==== > > strace: > > open("/dev/kvm", O_RDONLY) = 3 > ioctl(3, KVM_CREATE_VM, 0) = 4 > ioctl(4, KVM_CREATE_VCPU, 0x7) = 5 > ioctl(5, KVM_GET_PIT2 or KVM_GET_VCPU_EVENTS, 0x20010fef) = 0 > > Should be run in parallel (try increasing 10 to 100 or so, if this doesn't work) > > $ for x in `seq 1 10`; do { ./prog & }; done >