Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932586AbcJPRAT (ORCPT ); Sun, 16 Oct 2016 13:00:19 -0400 Received: from mail-vk0-f42.google.com ([209.85.213.42]:34448 "EHLO mail-vk0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932522AbcJPRAP (ORCPT ); Sun, 16 Oct 2016 13:00:15 -0400 MIME-Version: 1.0 In-Reply-To: <20161016002151.GA18235@hydra.tuxags.com> References: <20161016002151.GA18235@hydra.tuxags.com> From: Andy Lutomirski Date: Sun, 16 Oct 2016 09:59:54 -0700 Message-ID: Subject: Re: virtio-rng scatterlist null pointer dereference with VMAP_STACK=y To: "linux-kernel@vger.kernel.org" , Andy Lutomirski , linux-crypto@vger.kernel.org, Matt Mackall , Herbert Xu , Rusty Russell , Jens Axboe , Dave Gordon Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3396 Lines: 70 On Sat, Oct 15, 2016 at 5:21 PM, Matt Mullins wrote: > With VMAP_STACK=y and HW_RANDOM_VIRTIO=y, I get the following crash: > > [ 1.470437] BUG: unable to handle kernel NULL pointer dereference at (null) > [ 1.473350] IP: [] sg_init_one+0x65/0x90 > [ 1.474658] PGD 0 > [ 1.475169] Oops: 0000 [#1] SMP > > Entering kdb (current=0xffff880069b0c980, pid 1) on processor 1 Oops: (null) > due to oops @ 0xffffffff812f7c35 > CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.8.0-08682-g41844e3 #246 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > task: ffff880069b0c980 task.stack: ffffc90000c54000 > RIP: 0010:[] [] sg_init_one+0x65/0x90 > RSP: 0000:ffffc90000c57d00 EFLAGS: 00010246 > RAX: 0000000000000000 RBX: ffffc90000c57d20 RCX: 0000000000082000 > RDX: 0000000000000d68 RSI: 0000000410000c57 RDI: ffffc90000c57d40 > RBP: 0000000000000820 R08: 0000000000000000 R09: ffffc90000c57d20 > R10: 0000000000019228 R11: ffff88017fff8500 R12: 0000000000000010 > R13: 0000000000000010 R14: 0000000000000000 R15: 0000000000000000 > FS: 0000000000000000(0000) GS:ffff88017fc00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000000 CR3: 0000000001806000 CR4: 00000000001406a0 > Stack: > ffff8800694bf500 0000000000000001 ffffc90000c57d68 ffffffff8138286f > 0000000000000002 0000000000000000 0000000000000000 0000000000000000 > ffff8800694bf500 ffffc90000c57d68 ffff8800694bf500 0000000000000000 > Call Trace: > [] ? virtio_read+0x9f/0xe0 > [] ? add_early_randomness+0x3e/0xa0 > [] ? set_current_rng+0x3f/0x160 > [] ? hwrng_register+0x186/0x1d0 > [] ? virtrng_scan+0x10/0x20 > [] ? virtio_dev_probe+0x21e/0x2b0 > [] ? really_probe+0x14e/0x250 > [] ? __driver_attach+0x82/0xa0 > [] ? really_probe+0x250/0x250 > [] ? bus_for_each_dev+0x52/0x80 > [] ? bus_add_driver+0x1a3/0x220 > [] ? hwrng_modinit+0xc/0xc > [] ? driver_register+0x56/0xd0 > [] ? hwrng_modinit+0xc/0xc > [] ? do_one_initcall+0x32/0x150 > [] ? parse_args+0x170/0x390 > [] ? kernel_init_freeable+0x11e/0x1a3 > [] ? set_debug_rodata+0xc/0xc > [] ? rest_init+0x70/0x70 > [] ? kernel_init+0x5/0x100 > [] ? ret_from_fork+0x25/0x30 > Code: 01 c5 48 89 ee 48 89 e9 48 c1 ed 23 48 8b 04 ed c0 49 9c 81 48 c1 ee 0c > 48 c1 e9 1b 48 85 c0 74 0a 0f b6 c9 48 c1 e1 04 48 01 c8 <48> 8b 08 48 89 f0 89 > 53 08 48 c1 e0 06 44 89 63 0c 48 83 e1 fc > > > It looks like add_early_randomness() uses a buffer on the stack, which (with > VMAP_STACK) fails to be added to a scatterlist due to use of virt_to_page in > sg_set_buf(). > > None of this looks obviously wrong to me, but in combination it is not > functional. Hence, I don't have a particular fix in mind, and I've CC'ed folks > from both the hw_random and scatterlist history. Using a buffer on the stack is bogus here. Presumably virtio_read should allocate a heap buffer. --Andy -- Andy Lutomirski AMA Capital Management, LLC