leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
444fdad88f
linux/arch
History
Radim Krčmář 444fdad88f KVM: x86: fix out-of-bounds access in lapic 
Cluster xAPIC delivery incorrectly assumed that dest_id <= 0xff.
With enabled KVM_X2APIC_API_USE_32BIT_IDS in KVM_CAP_X2APIC_API, a
userspace can send an interrupt with dest_id that results in
out-of-bounds access.

Found by syzkaller:

  BUG: KASAN: slab-out-of-bounds in kvm_irq_delivery_to_apic_fast+0x11fa/0x1210 at addr ffff88003d9ca750
  Read of size 8 by task syz-executor/22923
  CPU: 0 PID: 22923 Comm: syz-executor Not tainted 4.9.0-rc4+ #49
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
   [...]
  Call Trace:
   [...] __dump_stack lib/dump_stack.c:15
   [...] dump_stack+0xb3/0x118 lib/dump_stack.c:51
   [...] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
   [...] print_address_description mm/kasan/report.c:194
   [...] kasan_report_error mm/kasan/report.c:283
   [...] kasan_report+0x231/0x500 mm/kasan/report.c:303
   [...] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:329
   [...] kvm_irq_delivery_to_apic_fast+0x11fa/0x1210 arch/x86/kvm/lapic.c:824
   [...] kvm_irq_delivery_to_apic+0x132/0x9a0 arch/x86/kvm/irq_comm.c:72
   [...] kvm_set_msi+0x111/0x160 arch/x86/kvm/irq_comm.c:157
   [...] kvm_send_userspace_msi+0x201/0x280 arch/x86/kvm/../../../virt/kvm/irqchip.c:74
   [...] kvm_vm_ioctl+0xba5/0x1670 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3015
   [...] vfs_ioctl fs/ioctl.c:43
   [...] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
   [...] SYSC_ioctl fs/ioctl.c:694
   [...] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
   [...] entry_SYSCALL_64_fastpath+0x1f/0xc2

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: stable@vger.kernel.org
Fixes: e45115b62f ("KVM: x86: use physical LAPIC array for logical x2APIC")
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
2016-11-24 18:35:53 +01:00
..
alpha Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
arc ARC fixes for 4.9-rc5 2016-11-11 16:51:50 -08:00
arm Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm 2016-11-20 10:27:39 -08:00
arm64 ARM: SoC fixes for v4.9-rc 2016-11-19 18:40:47 -08:00
avr32 Merge branch 'akpm' (patches from Andrew) 2016-10-07 21:38:00 -07:00
blackfin Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
c6x nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
cris cris/arch-v32: cryptocop: print a hex number after a 0x prefix 2016-10-27 18:43:43 -07:00
frv Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-11 23:38:39 -07:00
h8300 h8300: fix syscall restarting 2016-10-27 18:43:42 -07:00
hexagon nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
ia64 Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
m32r mm: replace access_process_vm() write parameter with gup_flags 2016-10-19 08:31:25 -07:00
m68k Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2016-10-14 14:26:58 -07:00
metag Metag architecture fixes for v4.9-rc1 2016-10-14 11:11:39 -07:00
microblaze Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-11 23:38:39 -07:00
mips One NULL pointer dereference, and two fixes for regressions introduced 2016-11-04 13:08:05 -07:00
mn10300 Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-11 23:38:39 -07:00
nios2 nios2: fix timer initcall return value 2016-11-11 08:45:08 -08:00
openrisc openrisc: Define __ro_after_init to avoid crash 2016-11-06 08:01:12 -08:00
parisc parisc: Ignore the pkey system calls for now 2016-11-02 23:07:14 +01:00
powerpc powerpc fixes for 4.9 #5 2016-11-19 11:21:59 -08:00
s390 Merge branch 'maybe-uninitialized' (patches from Arnd) 2016-11-11 10:03:01 -08:00
score Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
sh Minor changes to improve J2 support and match Kconfig expectations of 2016-10-19 11:21:06 -07:00
sparc sparc64: Handle extremely large kernel TLB range flushes more gracefully. 2016-10-27 09:11:05 -07:00
tile tile: handle __ro_after_init like parisc does 2016-11-14 16:46:41 -05:00
um nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
unicore32 unicore32: use simpler API for random address requests 2016-10-11 15:06:32 -07:00
x86 KVM: x86: fix out-of-bounds access in lapic 2016-11-24 18:35:53 +01:00
xtensa xtensa: wire up new pkey_{mprotect,alloc,free} syscalls 2016-11-14 12:31:49 -08:00
.gitignore
Kconfig This adds a new gcc plugin named "latent_entropy". It is designed to 2016-10-15 10:03:15 -07:00