Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964995AbcKXM0U (ORCPT ); Thu, 24 Nov 2016 07:26:20 -0500 Received: from mx1.redhat.com ([209.132.183.28]:32936 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S938696AbcKXM0S (ORCPT ); Thu, 24 Nov 2016 07:26:18 -0500 Subject: Re: [PATCH] KVM: x86: fix out-of-bounds accesses of rtc_eoi map To: =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , linux-kernel@vger.kernel.org, kvm@vger.kernel.org References: <20161123201527.28935-1-rkrcmar@redhat.com> Cc: Paolo Bonzini , stable@vger.kernel.org, Dmitry Vyukov , Steve Rutherford From: David Hildenbrand Organization: Red Hat GmbH Message-ID: <573e8431-a7fb-fc53-9e04-7007058fe1c9@redhat.com> Date: Thu, 24 Nov 2016 12:49:56 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <20161123201527.28935-1-rkrcmar@redhat.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Thu, 24 Nov 2016 11:50:00 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1637 Lines: 41 Am 23.11.2016 um 21:15 schrieb Radim Krčmář: > KVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be > bigger that the maximal number of VCPUs, resulting in out-of-bounds > access. > > Found by syzkaller: > > BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr [...] > Write of size 1 by task a.out/27101 > CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > [...] > Call Trace: > [...] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905 > [...] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495 > [...] kvm_irq_delivery_to_apic+0x732/0xc10 arch/x86/kvm/irq_comm.c:86 > [...] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360 > [...] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222 > [...] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235 > [...] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670 > [...] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668 > [...] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999 > [...] kvm_vm_ioctl+0x1fa/0x1a70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099 > > Reported-by: Dmitry Vyukov > Cc: stable@vger.kernel.org > Fixes: af1bae5497b9 ("KVM: x86: bump KVM_MAX_VCPU_ID to 1023") > Signed-off-by: Radim Krčmář > --- > Cc: Dmitry Vyukov > Cc: Steve Rutherford > --- Yes, the array and the bitmap are always accessed using vcpu_id, so this is correct. Reviewed-by: David Hildenbrand -- David