linux-kernel - kvm: GPF in kvm_ioapic_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 15 Nov 2016 05:56:24 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "x86@...nel.org" <x86@...nel.org>, KVM list <kvm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Steve Rutherford <srutherford@...gle.com>
Cc:     syzkaller <syzkaller@...glegroups.com>
Subject: kvm: GPF in kvm_ioapic_set_irq

Hello,

The following program triggers GPF in kvm_ioapic_set_irq:
https://gist.githubusercontent.com/dvyukov/9070377a9fdd685d4496972363b35ec5/raw/bfa9fc85736b6d4993138b945ddfa1b7f3432afc/gistfile1.txt


general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 3 PID: 11923 Comm: kworker/3:2 Not tainted 4.9.0-rc5+ #27
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: events irqfd_inject
task: ffff88006a06c7c0 task.stack: ffff880068638000
RIP: 0010:[<ffffffff81567e25>]  [<ffffffff81567e25>]
__lock_acquire+0xb35/0x3380 kernel/locking/lockdep.c:3221
RSP: 0000:ffff88006863ea20  EFLAGS: 00010006
RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000039 RSI: 0000000000000000 RDI: 1ffff1000d0c7d9e
RBP: ffff88006863ef58 R08: 0000000000000001 R09: 0000000000000000
R10: 00000000000001c8 R11: 0000000000000000 R12: ffff88006a06c7c0
R13: 0000000000000001 R14: ffffffff8baab1a0 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88006d100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004abdd0 CR3: 000000003e2f2000 CR4: 00000000000026e0
Stack:
 ffffffff894d0098 1ffff1000d0c7d56 ffff88006863ecd0 dffffc0000000000
 ffff88006a06c7c0 0000000000000000 ffff88006863ecf8 0000000000000082
 0000000000000000 ffffffff815dd7c1 ffffffff00000000 ffffffff00000000
Call Trace:
 [<ffffffff8156b542>] lock_acquire+0x2a2/0x790 kernel/locking/lockdep.c:3746
 [<     inline     >] __raw_spin_lock include/linux/spinlock_api_smp.h:144
 [<ffffffff881422b8>] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151
 [<     inline     >] spin_lock include/linux/spinlock.h:302
 [<ffffffff8118214c>] kvm_ioapic_set_irq+0x4c/0x100 arch/x86/kvm/ioapic.c:379
 [<ffffffff811838ff>] kvm_set_ioapic_irq+0x8f/0xc0 arch/x86/kvm/irq_comm.c:52
 [<ffffffff81090729>] kvm_set_irq+0x239/0x640
arch/x86/kvm/../../../virt/kvm/irqchip.c:101
 [<ffffffff810898e4>] irqfd_inject+0xb4/0x150
arch/x86/kvm/../../../virt/kvm/eventfd.c:60
 [<ffffffff81473050>] process_one_work+0xb40/0x1ba0 kernel/workqueue.c:2096
 [<ffffffff814742c4>] worker_thread+0x214/0x18a0 kernel/workqueue.c:2230
 [<ffffffff81489ee8>] kthread+0x328/0x3e0 kernel/kthread.c:209
 [<ffffffff88143b1a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
Code: e9 03 f3 48 ab 48 81 c4 10 05 00 00 44 89 e8 5b 41 5c 41 5d 41
5e 41 5f 5d c3 4c 89 d2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
3c 02 00 0f 85 00 26 00 00 49 81 3a c0 74 e1 8a 41 bf 00 00
RIP  [<ffffffff81567e25>] __lock_acquire+0xb35/0x3380
kernel/locking/lockdep.c:3221
 RSP <ffff88006863ea20>
---[ end trace 9e23ceae3896b509 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1

On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (Nov 13).