From patchwork Mon Nov 4 06:27:58 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wanpeng Li X-Patchwork-Id: 11224967 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EB2BD1599 for ; Mon, 4 Nov 2019 06:28:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CA086222C6 for ; Mon, 4 Nov 2019 06:28:17 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bi7os8Mn" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728332AbfKDG2K (ORCPT ); Mon, 4 Nov 2019 01:28:10 -0500 Received: from mail-pg1-f196.google.com ([209.85.215.196]:40432 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727911AbfKDG2J (ORCPT ); Mon, 4 Nov 2019 01:28:09 -0500 Received: by mail-pg1-f196.google.com with SMTP id 15so10602674pgt.7; Sun, 03 Nov 2019 22:28:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=ZYR0xt4j6M9ghT6gn2+jBhsiyfXvuB7wHMizn4V6mhs=; b=bi7os8MneiCUSdHm3w8wp6PYtlt3SIcJpGjVPC3e9PC3Q7uf1JJ/E2TQSeIP+gqb3N D3FMWZI+HlqfshmITItNDVbMPqlniVZRuFlIt/FhUHWSDA7zXLRJ5btK6I7DiKQqerjW kPgBxmJSEx8H8XwSlpqIzbZ0Kkij1iTwhHr9xrzJVbImrHUpc10HxAQfctJ5ZIwv8Tp0 RrdynQhshXrRMJbsFEoJxc9Qih15/k9oYheyVLasu0NeSUNATDb8AYGRrgSfKNlg7E6o GQDJESuDTlAgRmrlTCYupV6HbZ/BuhHTKPmKgbrT+Zyg5txGL2Ha/y/MpQVkBwWobKuz xfxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=ZYR0xt4j6M9ghT6gn2+jBhsiyfXvuB7wHMizn4V6mhs=; b=e7Xj4HOCJtISrSryKgwFTvlYew/iwyn/HgOXWBMRZSQns0VVPc1hQ4fGBcYGpE1cL+ +CETdfVF435rfwckyM8QjxZaZufait46EpN5CzQOXWdPGvtzWSBHnwcpSgYU71dR8xlt lPHtA3b3J2wrepZbAbhN20jCtbT50c9fvaubrFYIyGknePUlrwVwrfXm+28Djbs4sxvV 5YvAOJmfq2NPWNx9VWNBfAFHrZK+a+1mBa/YvBYTFW5y+MHdqvVvHt7pyD0AzCSLS8er nJM5qKkrm8rzw4xkY8dabyAm77hsnkmuyclvPs/dd052pNoU4+mlcWKT7MNQSyqnNlG3 Zd4Q== X-Gm-Message-State: APjAAAXV73YGyhHkyfGXQXPIrmLyrXf/59DDyzCOtIy3H7RGp7zoM6sk vr9RZDXP5OYg8jNxUB2oNRaD/kCP X-Google-Smtp-Source: APXvYqxkJtkIRCkBSJNATceZJHKNaDtsagBi74sUOjSxtwBqNhWjB7hIbN0o0A/qXdoLJzjQSsqBFg== X-Received: by 2002:a17:90a:bb0a:: with SMTP id u10mr33656628pjr.14.1572848887315; Sun, 03 Nov 2019 22:28:07 -0800 (PST) Received: from localhost.localdomain ([203.205.141.123]) by smtp.googlemail.com with ESMTPSA id z7sm7810505pgk.10.2019.11.03.22.28.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 03 Nov 2019 22:28:06 -0800 (PST) From: Wanpeng Li X-Google-Original-From: Wanpeng Li To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Paolo Bonzini , =?utf-8?b?UmFkaW0gS3LEjW3DocWZ?= , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel Subject: [PATCH 1/2] KVM: Fix NULL-ptr defer after kvm_create_vm fails Date: Mon, 4 Nov 2019 14:27:58 +0800 Message-Id: <1572848879-21011-1-git-send-email-wanpengli@tencent.com> X-Mailer: git-send-email 2.7.4 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Wanpeng Li Reported by syzkaller: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 14727 Comm: syz-executor.3 Not tainted 5.4.0-rc4+ #0 RIP: 0010:kvm_coalesced_mmio_init+0x5d/0x110 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:121 Call Trace: kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:3446 [inline] kvm_dev_ioctl+0x781/0x1490 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3494 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0x196/0x1150 fs/ioctl.c:696 ksys_ioctl+0x62/0x90 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:718 do_syscall_64+0xca/0x5d0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Commit 9121923c457d ("kvm: Allocate memslots and buses before calling kvm_arch_init_vm") moves memslots and buses allocations around, however, if kvm->srcu/irq_srcu fails initialization, NULL will be returned instead of error code, NULL will not be intercepted in kvm_dev_ioctl_create_vm() and be deferenced by kvm_coalesced_mmio_init(), this patch fixes it. syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13509b84e00000 Reported-by: syzbot+89a8060879fa0bd2db4f@syzkaller.appspotmail.com Fixes: 9121923c457d ("kvm: Allocate memslots and buses before calling kvm_arch_init_vm") Cc: Jim Mattson Signed-off-by: Wanpeng Li Acked-by: Christian Borntraeger --- virt/kvm/kvm_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index d6f0696..8c272eb 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -675,6 +675,7 @@ static struct kvm *kvm_create_vm(unsigned long type) INIT_HLIST_HEAD(&kvm->irq_ack_notifier_list); #endif + r = -ENOMEM; if (init_srcu_struct(&kvm->srcu)) goto out_err_no_srcu; if (init_srcu_struct(&kvm->irq_srcu)) From patchwork Mon Nov 4 06:27:59 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wanpeng Li X-Patchwork-Id: 11224965 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id ACF2E139A for ; Mon, 4 Nov 2019 06:28:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8A30E20848 for ; Mon, 4 Nov 2019 06:28:15 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="T/npz0Rd" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728367AbfKDG2M (ORCPT ); Mon, 4 Nov 2019 01:28:12 -0500 Received: from mail-pf1-f193.google.com ([209.85.210.193]:43078 "EHLO mail-pf1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727911AbfKDG2L (ORCPT ); Mon, 4 Nov 2019 01:28:11 -0500 Received: by mail-pf1-f193.google.com with SMTP id 3so11458799pfb.10; Sun, 03 Nov 2019 22:28:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=2OtwjKZ1o9BlPFo9MmqlnhkpjgLbY+pfS9lNNjoKCmc=; b=T/npz0RdlYaEe1kuqJUtS2GEYAu4quFvYbf+oWj2p+3Wp8NDVAB0OFV7UcoxLCA/He tdIwotd2rfdjNJD5CeuzxfQTg6+zChJAnv7hmmIbA/JIjLUqnSdSUvMZHrthlYChwj4J Ng/cPF95vWdp4OCv/MLzzvnIQWAc/jG5RhMBXI4CWFCsDx083wqTW7XtEk8hbK0aM9nU t1v1nUrRNRQ+WomXz77Oz4Qgb29/SX9zqEif27/5MR24mv8FLdAjBdEwcr2ZrIv1x4lx Xb9bXFDSvZwRhG19G5FfF9kVSDcdfiiYcTLD0mB40AIGfoRRlJ92gygyu8vnkbk+Plfx cXGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=2OtwjKZ1o9BlPFo9MmqlnhkpjgLbY+pfS9lNNjoKCmc=; b=fG9BViyoY3aNGI5A2QG16XqgKyKNc6UOkSeuD25UcnnoHoKzuAt4m8emIHuhZi6aNQ 7goXUvmwVXxqKZ1fN2/dwDvoMehl2iZdtcf7wZ6mnO84idAN2tkoAgIAt9c+pk9XLbkc Z6pjCUVQYtUMdDfbkyYn/I39Jh5qnEyGpJrPQ+sc/RFzOHsb7Mo92hxlwFzTEqjhwcUz PEnr71k22qQhDLzBTl3mM2Zl4AsUGkprHCxuD//A9fCvSdXfkPjxldSQmKqvExf0twBG cSMEKNdNUw1Lf9gJKbrnrAa98gsJrowLc5YSc5hxoda9xCo6cMMyvQ4qmIlN++TgEfHv FGDw== X-Gm-Message-State: APjAAAWu8Hqsw3bmfoh4XiF7m2Euc3pkufWaeTij5ESfTVdOaq9zA0DR oLzLjYGzpzvHLaEzjrPh05XUDp2v X-Google-Smtp-Source: APXvYqweKAOvqr9QdiEMGxa1aKPl9xbFKqkAQoidoD1IYf0AjKuuICSneWHAk66sEBNGKRmOMZadIw== X-Received: by 2002:a63:6cb:: with SMTP id 194mr1871805pgg.327.1572848890353; Sun, 03 Nov 2019 22:28:10 -0800 (PST) Received: from localhost.localdomain ([203.205.141.123]) by smtp.googlemail.com with ESMTPSA id z7sm7810505pgk.10.2019.11.03.22.28.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 03 Nov 2019 22:28:09 -0800 (PST) From: Wanpeng Li X-Google-Original-From: Wanpeng Li To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Paolo Bonzini , =?utf-8?b?UmFkaW0gS3LEjW3DocWZ?= , Sean Christopherson , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel Subject: [PATCH 2/2] KVM: Fix rcu splat if vm creation fails Date: Mon, 4 Nov 2019 14:27:59 +0800 Message-Id: <1572848879-21011-2-git-send-email-wanpengli@tencent.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1572848879-21011-1-git-send-email-wanpengli@tencent.com> References: <1572848879-21011-1-git-send-email-wanpengli@tencent.com> Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org From: Wanpeng Li Reported by syzkaller: ============================= WARNING: suspicious RCU usage ----------------------------- ./include/linux/kvm_host.h:536 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by repro_11/12688. stack backtrace: Call Trace: dump_stack+0x7d/0xc5 lockdep_rcu_suspicious+0x123/0x170 kvm_dev_ioctl+0x9a9/0x1260 [kvm] do_vfs_ioctl+0x1a1/0xfb0 ksys_ioctl+0x6d/0x80 __x64_sys_ioctl+0x73/0xb0 do_syscall_64+0x108/0xaa0 entry_SYSCALL_64_after_hwframe+0x49/0xbe Commit a97b0e773e4 (kvm: call kvm_arch_destroy_vm if vm creation fails) sets users_count to 1 before kvm_arch_init_vm(), however, if kvm_arch_init_vm() fails, we need to dec this count. Or, we can move the sets refcount after kvm_arch_init_vm(). syzkaller source: https://syzkaller.appspot.com/x/repro.c?x=15209b84e00000 Reported-by: syzbot+75475908cd0910f141ee@syzkaller.appspotmail.com Fixes: a97b0e773e49 ("kvm: call kvm_arch_destroy_vm if vm creation fails") Cc: Jim Mattson Signed-off-by: Wanpeng Li --- virt/kvm/kvm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index d6f0696..62ae0c9 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -662,11 +662,11 @@ static struct kvm *kvm_create_vm(unsigned long type) goto out_err_no_arch_destroy_vm; } - refcount_set(&kvm->users_count, 1); r = kvm_arch_init_vm(kvm, type); if (r) goto out_err_no_arch_destroy_vm; + refcount_set(&kvm->users_count, 1); r = hardware_enable_all(); if (r) goto out_err_no_disable;