From patchwork Thu Jan 5 09:05:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Wanpeng Li X-Patchwork-Id: 9498721 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9AD12606B5 for ; Thu, 5 Jan 2017 09:07:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8F3D227D5E for ; Thu, 5 Jan 2017 09:07:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 83F1727FA3; Thu, 5 Jan 2017 09:07:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 94FC927D5E for ; Thu, 5 Jan 2017 09:07:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S970249AbdAEJGY (ORCPT ); Thu, 5 Jan 2017 04:06:24 -0500 Received: from mail-pf0-f194.google.com ([209.85.192.194]:32982 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S970245AbdAEJFy (ORCPT ); Thu, 5 Jan 2017 04:05:54 -0500 Received: by mail-pf0-f194.google.com with SMTP id 127so18265805pfg.0; Thu, 05 Jan 2017 01:05:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=tFWAnGRGDL1+jalQPsGvlEKB3eByEHdEjGJh1KZBg6Y=; b=G5XS3aNRuNQWoLn9CZEb+83GMpyqF0G5KDB09lX3/QwHEuOc7r4JBLfTcgOgca4bIl yZgH9TRonoWRPaTm0K6gukmGAAlcj6wxuHyYcRgODTLXffY0nUi7Q5Rka2psX7xMC1oE FeTa+pRhNxFgdE5q/u0TxEaYQ3gHOuKFfClJQ+kp3HaRB6/ts5nQFrfBJvImfHJT4F3T UybsnPYm+KOXJxSNjwIdNGghji95aMDkITmPO6OIg2Otm/M/1QGI5OF6vn2HGhy3xOj3 0BZNXOXhikz2y1dpRPZ58Tdwa/mBmNWjfoowUktLl2YW3yyFo9GACnaeTQ2dj/Jlt68a OHkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=tFWAnGRGDL1+jalQPsGvlEKB3eByEHdEjGJh1KZBg6Y=; b=V5+VbG/5sQx2TQM40//C+MMpfeO3Ry6MXPlG07Mb4d/42YcoXT2lcBBnF1Lva9qFHU tbbuUpuTWZjKx//8qfLIMA4EfJ3GCJvOIE6btBpiwENUX04Qo8HQQIi0RR0hnoxWKARp rF7ddtU878+oejNc4B2znR32Dzv3L8FQJmDaG6g5RrMvk89+eegH3xxzDibBSyvn5Rmb EXjgW2XHKGBALu5k3qbMVR4fSGUzNJgYKEnAcxNknvikrEmUk4O00iRuLIx4F33mXD1P /SxjYZbRsqxbahCaz08TgeRNVoQuQw6C06g+Huc5Lo11PXIggWMbHTJdF5KHzWQI0gJi iucw== X-Gm-Message-State: AIkVDXKLQxbG1Au6dQIbUhUfdSABCv0KFhJBsIqz7cIM3iE+YRyisdnk58b/W3Ws7fEjyA== X-Received: by 10.99.1.132 with SMTP id 126mr131092537pgb.129.1483607118474; Thu, 05 Jan 2017 01:05:18 -0800 (PST) Received: from localhost ([203.205.141.123]) by smtp.gmail.com with ESMTPSA id c8sm152076192pfe.15.2017.01.05.01.05.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 05 Jan 2017 01:05:17 -0800 (PST) From: Wanpeng Li X-Google-Original-From: Wanpeng Li To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Dmitry Vyukov , Wanpeng Li Subject: [PATCH] KVM: eventfd: fix NULL deref irqbypass consumer Date: Thu, 5 Jan 2017 01:05:11 -0800 Message-Id: <1483607111-2780-1-git-send-email-wanpeng.li@hotmail.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Wanpeng Li Reported syzkaller: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass] PGD 0 Oops: 0002 [#1] SMP CPU: 1 PID: 125 Comm: kworker/1:1 Not tainted 4.9.0+ #1 Workqueue: kvm-irqfd-cleanup irqfd_shutdown [kvm] task: ffff9bbe0dfbb900 task.stack: ffffb61802014000 RIP: 0010:irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass] Call Trace: irqfd_shutdown+0x66/0xa0 [kvm] process_one_work+0x16b/0x480 worker_thread+0x4b/0x500 kthread+0x101/0x140 ? process_one_work+0x480/0x480 ? kthread_create_on_node+0x60/0x60 ret_from_fork+0x25/0x30 RIP: irq_bypass_unregister_consumer+0x9d/0xb70 [irqbypass] RSP: ffffb61802017e20 CR2: 0000000000000008 The syzkaller folks reported a NULL pointer dereference that due to unregister an consumer which fails registration before. The syzkaller creates two VMs w/ an equal eventfd occassionally. So the second VM fails to register an irqbypass consumer. It will make irqfd as inactive and queue an workqueue work to shutdown irqfd and unregister the irqbypass consumer when eventfd is closed. However, the second consumer has been initialized though it fails registration. So the token (same as the first VM's) is taken to unregister the consumer in the workqueue, the consumer of the first VM is found and unregistered, then NULL deref incurred in the path of deleting consumer from the consumers list. #include #include #include #include #include #include #include #include #include #include #include #include #include #include __thread int skip_segv; __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* uctx) { if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED)) _longjmp(segv_env, 1); exit(sig); } static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8) { return syscall(nr, a0, a1, a2, a3, a4, a5); } long r[28]; void* thr(void* arg) { switch ((long)arg) { case 0: r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0xd000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0); break; case 1: r[2] = syscall(__NR_open, "/dev/kvm", 0x40042ul, 0, 0, 0, 0, 0, 0); break; case 2: r[3] = execute_syscall(__NR_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0, 0, 0, 0); break; case 3: r[4] = execute_syscall(__NR_ioctl, r[3], 0xae41ul, 0x3fful, 0, 0, 0, 0, 0, 0); break; case 4: r[5] = execute_syscall(__NR_ioctl, r[4], 0xae9aul, 0, 0, 0, 0, 0, 0, 0); break; case 5: r[6] = execute_syscall(__NR_eventfd2, 0x8ul, 0x801ul, 0, 0, 0, 0, 0, 0, 0); break; case 6: NONFAILING(*(uint32_t*)0x2000c000 = r[6]); NONFAILING(*(uint32_t*)0x2000c004 = (uint32_t)0x98cd); NONFAILING(*(uint32_t*)0x2000c008 = (uint32_t)0x0); NONFAILING(*(uint32_t*)0x2000c00c = (uint32_t)0xffffffffffffffff); NONFAILING(*(uint8_t*)0x2000c010 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c011 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c012 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c013 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c014 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c015 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c016 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c017 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c018 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c019 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01a = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01b = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01c = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01d = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01e = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000c01f = (uint8_t)0x0); r[27] = execute_syscall(__NR_ioctl, r[3], 0x4020ae76ul, 0x2000c000ul, 0, 0, 0, 0, 0, 0); break; } return 0; } int main() { long i; pthread_t th[14]; install_segv_handler(); memset(r, -1, sizeof(r)); srand(getpid()); for (i = 0; i < 7; i++) { pthread_create(&th[i], 0, thr, (void*)i); usleep(10000); } for (i = 0; i < 7; i++) { pthread_create(&th[7 + i], 0, thr, (void*)i); if (rand() % 2) usleep(rand() % 10000); } usleep(100000); return 0; } This patch fix it by destroying the consumer which just fails registration. Reported-by: Dmitry Vyukov Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Dmitry Vyukov Signed-off-by: Wanpeng Li --- virt/kvm/eventfd.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c index a29786d..eeaf056 100644 --- a/virt/kvm/eventfd.c +++ b/virt/kvm/eventfd.c @@ -415,9 +415,15 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) irqfd->consumer.stop = kvm_arch_irq_bypass_stop; irqfd->consumer.start = kvm_arch_irq_bypass_start; ret = irq_bypass_register_consumer(&irqfd->consumer); - if (ret) + if (ret) { pr_info("irq bypass consumer (token %p) registration fails: %d\n", irqfd->consumer.token, ret); + irqfd->consumer.token = NULL; + irqfd->consumer.add_producer = NULL; + irqfd->consumer.del_producer = NULL; + irqfd->consumer.stop = NULL; + irqfd->consumer.start = NULL; + } } #endif