From patchwork Mon Dec 20 13:18:43 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Ren X-Patchwork-Id: 12687871 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id AFDADC433EF for ; Mon, 20 Dec 2021 13:18:57 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C5FDD6B0071; Mon, 20 Dec 2021 08:18:56 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id C0F3C6B0073; Mon, 20 Dec 2021 08:18:56 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AB0A46B0074; Mon, 20 Dec 2021 08:18:56 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0210.hostedemail.com [216.40.44.210]) by kanga.kvack.org (Postfix) with ESMTP id 9B5E76B0071 for ; Mon, 20 Dec 2021 08:18:56 -0500 (EST) Received: from smtpin12.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 4E623181AC9C6 for ; Mon, 20 Dec 2021 13:18:56 +0000 (UTC) X-FDA: 78938227872.12.359629C Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by imf29.hostedemail.com (Postfix) with ESMTP id B1727120041 for ; Mon, 20 Dec 2021 13:18:52 +0000 (UTC) Received: by mail-pj1-f42.google.com with SMTP id a11-20020a17090a854b00b001b11aae38d6so10133075pjw.2 for ; Mon, 20 Dec 2021 05:18:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Lzl6bfuldEpY/zQVQAPEJiobO0CgOYhBczOEU/LbH9U=; b=O+9VEm0ewbVYy1X6H6hMCOO0dS+F5fsqLGuPrAIHCvk7NquMl7MVwM3hSXQjgZZZtB 9MsRHvT4/FtTdoN+jJ1um6zE0UsL91MNeqHzWy6WOkT81bWCBos5uo7R0mIyyUp6jEyx NkSbBTpBwP3Bfy9pNLO7Ms6KXCKyypro5DjxGDCEP5k7qDR8pQyoZg9STevrfiq50wIF KRPz9a6J+iFF7Sx9ytQ9CqXLGPCiAVfhRuJjEJHmRvf9HjgG/PML72kSnOzW5JTjqGfS bz5aFLcMwkua3mUoXs0R2c33rgsfflDD3sDcMpg/V68sbwlE9+ZPeXYXRGJEUeag+LZW i5yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Lzl6bfuldEpY/zQVQAPEJiobO0CgOYhBczOEU/LbH9U=; b=X5kHjf10gH/P5UKA2Vy0HwABhsXx+DLZ6pKsIS13umStEUueL2RXnx/xeAWf4YMlmH m4jfulTZwSs18TDKHAyiSFeexIGZa8gtALMNuIKy1qDJCXsUnku2lyBDjtyQc+MOhIhU 3y5I/9ToRtIdF4cqsgjWTWv1f91auyRxO818J0nLwb5fg1Hi0pCI0fH531AxZNNl5hpc k9fEBKQROQbdb6ULmXRFu1IUGbqA2WXE3wI+r8GG6aEAZaMIS1H8+fXZyKn186k+xpXe R04refz0opRU3qKpGrW/ERqkV+BXxZ84XdG8nNQdFepnyLNAiyTZuye02COKUgttYTZp RbHQ== X-Gm-Message-State: AOAM53173d5z/qTHuFWLF8rZDhHP9trcQhDVAj36/MOhZp01jIXAoH2d ovJB9xqToGU56/g+hxgijAg= X-Google-Smtp-Source: ABdhPJwMHF5kWpUGLoAe2vWXF9oqA/v9Uk35VVZueict/JuNbLt4yFfNUOn/Cq6ohWjQED9alJiBkg== X-Received: by 2002:a17:90b:1b4a:: with SMTP id nv10mr2131117pjb.245.1640006334640; Mon, 20 Dec 2021 05:18:54 -0800 (PST) Received: from localhost.localdomain ([205.204.117.115]) by smtp.gmail.com with ESMTPSA id s3sm7892858pfm.0.2021.12.20.05.18.52 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 20 Dec 2021 05:18:53 -0800 (PST) From: Eric Ren To: david@redhat.com, linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org, vbabka@suse.cz, ziy@nvidia.com, renzhengeek@gmail.com Subject: [PATCH v2] virtio_mem: fix panic on mb_states indexing overflow Date: Mon, 20 Dec 2021 21:18:43 +0800 Message-Id: X-Mailer: git-send-email 2.30.1 (Apple Git-130) MIME-Version: 1.0 X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: B1727120041 X-Stat-Signature: 1fp4b7jt1i97xteaxbytf37bodctu45i Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=O+9VEm0e; spf=pass (imf29.hostedemail.com: domain of renzhengeek@gmail.com designates 209.85.216.42 as permitted sender) smtp.mailfrom=renzhengeek@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-HE-Tag: 1640006332-873045 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: `mb_id` is unsigned integer, which is used to index `mb_states` array in reverse order. `mb_id` can decrease to `0UL - 1` that is a very large number, causing invalid address access. The calltrace is like below: ``` [ 286.344977] BUG: unable to handle page fault for address: ffffa95180cf8fff [ 286.345800] #PF: supervisor read access in kernel mode [ 286.346738] #PF: error_code(0x0000) - not-present page [ 286.347440] PGD 1000067 P4D 1000067 PUD 138c067 PMD 1840435067 PTE 0 [ 286.348156] Oops: 0000 [#1] SMP PTI [ 286.348556] CPU: 1 PID: 122 Comm: kworker/1:2 Tainted: G OE ... [ 286.350740] Workqueue: events_freezable virtio_mem_run_wq [virtio_mem] [ 286.351605] RIP: 0010:virtio_mem_unplug_request+0x418/0x890 [virtio_mem] [ 286.352519] Code: 0f 87 fc 00 00 00 4a 63 54 ac 30 48 83 bc d5 f8 00 00 00 00 48 89 d0 0f 8 4 e5 00 00 00 48 8b b5 38 01 00 00 4c 89 e2 48 29 ca <0f> b6 34 16 39 c6 75 c7 40 80 fe 02 0f 82 a4 01 00 00 40 80 fe 03 [ 286.355030] RSP: 0018:ffffa95181c4bd50 EFLAGS: 00010286 [ 286.355737] RAX: 0000000000000005 RBX: 0000000000006100 RCX: 0000000000000000 [ 286.356752] RDX: ffffffffffffffff RSI: ffffa95180cf9000 RDI: ffff8e5dc393b348 [ 286.357649] RBP: ffff8e5dc393b200 R08: ffff8e463cd2b610 R09: 0000000000000021 [ 286.358627] R10: ffffa95181c4bcd0 R11: ffffa95181c4baa0 R12: ffffffffffffffff [ 286.359617] R13: 0000000000000003 R14: ffff8e5dc393b348 R15: 00000000fffffff0 [ 286.360503] FS: 0000000000000000(0000) GS:ffff8e463cd00000(0000) knlGS:0000000000000000 [ 286.361532] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 286.362229] CR2: ffffa95180cf8fff CR3: 0000001846234000 CR4: 00000000000006e0 [ 286.363168] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 286.364162] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 286.365054] Call Trace: [ 286.365431] ? virtio_mem_run_wq+0x5a4/0x870 [virtio_mem] [ 286.366132] ? __schedule+0x4b3/0x800 [ 286.366547] ? process_one_work+0x18b/0x350 [ 286.367041] ? worker_thread+0x4f/0x3a0 [ 286.367675] ? rescuer_thread+0x350/0x350 [ 286.368234] ? kthread+0xfa/0x130 [ 286.368605] ? kthread_create_worker_on_cpu+0x70/0x70 [ 286.369155] ? ret_from_fork+0x1f/0x30 ``` Fixes by also checking its up boundary. Signed-off-by: Eric Ren --- v2: Correct the SOB Use _vm and remove duplicated spaces --- drivers/virtio/virtio_mem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/virtio/virtio_mem.c b/drivers/virtio/virtio_mem.c index 96e5a8782769..f1ba0dadd47a 100644 --- a/drivers/virtio/virtio_mem.c +++ b/drivers/virtio/virtio_mem.c @@ -486,7 +486,9 @@ static int virtio_mem_sbm_mb_states_prepare_next_mb(struct virtio_mem *vm) #define virtio_mem_sbm_for_each_mb_rev(_vm, _mb_id, _state) \ for (_mb_id = _vm->sbm.next_mb_id - 1; \ - _mb_id >= _vm->sbm.first_mb_id && _vm->sbm.mb_count[_state]; \ + _mb_id >= _vm->sbm.first_mb_id && \ + _mb_id < _vm->sbm.next_mb_id && \ + _vm->sbm.mb_count[_state]; \ _mb_id--) \ if (virtio_mem_sbm_get_mb_state(_vm, _mb_id) == _state)