Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933745AbcKVTeL (ORCPT ); Tue, 22 Nov 2016 14:34:11 -0500 Received: from mail-wm0-f65.google.com ([74.125.82.65]:33290 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932483AbcKVTeG (ORCPT ); Tue, 22 Nov 2016 14:34:06 -0500 Subject: Re: [PATCH] KVM: x86: fix out-of-bounds access in lapic To: =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , linux-kernel@vger.kernel.org, kvm@vger.kernel.org References: <20161122192014.19773-1-rkrcmar@redhat.com> Cc: stable@vger.kernel.org, Dmitry Vyukov , Steve Rutherford From: Paolo Bonzini Message-ID: Date: Tue, 22 Nov 2016 20:33:43 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <20161122192014.19773-1-rkrcmar@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2601 Lines: 61 On 22/11/2016 20:20, Radim Krčmář wrote: > Cluster xAPIC delivery incorrectly assumed that dest_id <= 0xff. > With enabled KVM_X2APIC_API_USE_32BIT_IDS in KVM_CAP_X2APIC_API, a > userspace can send an interrupt with dest_id that results in > out-of-bounds access. > > Found by syzkaller: > > BUG: KASAN: slab-out-of-bounds in kvm_irq_delivery_to_apic_fast+0x11fa/0x1210 at addr ffff88003d9ca750 > Read of size 8 by task syz-executor/22923 > CPU: 0 PID: 22923 Comm: syz-executor Not tainted 4.9.0-rc4+ #49 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > [...] > Call Trace: > [...] __dump_stack lib/dump_stack.c:15 > [...] dump_stack+0xb3/0x118 lib/dump_stack.c:51 > [...] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156 > [...] print_address_description mm/kasan/report.c:194 > [...] kasan_report_error mm/kasan/report.c:283 > [...] kasan_report+0x231/0x500 mm/kasan/report.c:303 > [...] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:329 > [...] kvm_irq_delivery_to_apic_fast+0x11fa/0x1210 arch/x86/kvm/lapic.c:824 > [...] kvm_irq_delivery_to_apic+0x132/0x9a0 arch/x86/kvm/irq_comm.c:72 > [...] kvm_set_msi+0x111/0x160 arch/x86/kvm/irq_comm.c:157 > [...] kvm_send_userspace_msi+0x201/0x280 arch/x86/kvm/../../../virt/kvm/irqchip.c:74 > [...] kvm_vm_ioctl+0xba5/0x1670 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3015 > [...] vfs_ioctl fs/ioctl.c:43 > [...] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679 > [...] SYSC_ioctl fs/ioctl.c:694 > [...] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 > [...] entry_SYSCALL_64_fastpath+0x1f/0xc2 > > Reported-by: Dmitry Vyukov > Cc: stable@vger.kernel.org > Fixes: e45115b62f9a ("KVM: x86: use physical LAPIC array for logical x2APIC") > Signed-off-by: Radim Krčmář > --- > Cc: Dmitry Vyukov > Cc: Steve Rutherford > --- > arch/x86/kvm/lapic.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c > index 09edd32b8e42..34a66b2d47e6 100644 > --- a/arch/x86/kvm/lapic.c > +++ b/arch/x86/kvm/lapic.c > @@ -138,7 +138,7 @@ static inline bool kvm_apic_map_get_logical_dest(struct kvm_apic_map *map, > *mask = dest_id & 0xff; > return true; > case KVM_APIC_MODE_XAPIC_CLUSTER: > - *cluster = map->xapic_cluster_map[dest_id >> 4]; > + *cluster = map->xapic_cluster_map[(dest_id >> 4) & 0xf]; > *mask = dest_id & 0xf; > return true; > default: > Reviewed-by: Paolo Bonzini