linux-kernel - kvm: slab-out-of-bounds write in __apic_accept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 Nov 2016 11:22:13 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "x86@...nel.org" <x86@...nel.org>, KVM list <kvm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Steve Rutherford <srutherford@...gle.com>
Cc:     syzkaller <syzkaller@...glegroups.com>
Subject: kvm: slab-out-of-bounds write in __apic_accept_irq

Hello,

The following program triggers slab-out-of-bounds write in __apic_accept_irq:

https://gist.githubusercontent.com/dvyukov/6ef34f4a775091d664e18308aa0d5fa6/raw/bf12c7261fbb20cb0ff4318316f0fae7bd948eff/gistfile1.txt

On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (4.9-rc5)

==================================================================
BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at
addr ffff880035d4918f
Write of size 1 by task a.out/27101
CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff880035c16ff0 ffffffff834c2a59 ffffffff00000001 1ffff10006b82d91
 ffffed0006b82d89 0000000041b58ab3 ffffffff895758d0 ffffffff834c276b
 0000000041b58ab3 0000000000000000 0000000000000002 1ffff10006b82d95
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff834c2a59>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51
 [<ffffffff819f09f1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:159
 [<     inline     >] print_address_description mm/kasan/report.c:197
 [<     inline     >] kasan_report_error mm/kasan/report.c:286
 [<ffffffff819f0cdb>] kasan_report+0x1eb/0x4c0 mm/kasan/report.c:306
 [<ffffffff819f106c>] __asan_report_store1_noabort+0x1c/0x20
mm/kasan/report.c:334
 [<ffffffff8116fb53>] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905
 [<ffffffff8117245e>] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495
 [<ffffffff81184ea2>] kvm_irq_delivery_to_apic+0x732/0xc10
arch/x86/kvm/irq_comm.c:86
 [<ffffffff8118064d>] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360
 [<ffffffff811817c5>] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222
 [<     inline     >] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235
 [<ffffffff81183653>] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670
 [<     inline     >] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668
 [<ffffffff810dfe18>] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999
 [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70
arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679
 [<     inline     >] SYSC_ioctl fs/ioctl.c:694
 [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685
 [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6
arch/x86/entry/entry_64.S:209

Object at ffff880035d48bc0, in cache kmalloc-2048 size: 2048
Allocated:
PID = 27101
 [  291.279030] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20
 [  291.279030] [<ffffffff819efce3>] save_stack+0x43/0xd0
 [  291.279030] [<ffffffff819effad>] kasan_kmalloc+0xad/0xe0
 [  291.279030] [<ffffffff819ec32c>] kmem_cache_alloc_trace+0x12c/0x710
 [  291.279030] [<ffffffff81182ca0>] kvm_ioapic_init+0xa0/0x680
 [  291.279030] [<ffffffff810df5e7>] kvm_arch_vm_ioctl+0x11d7/0x23c0
 [  291.279030] [<ffffffff81082b4a>] kvm_vm_ioctl+0x1fa/0x1a70
 [  291.279030] [<ffffffff81abcc44>] do_vfs_ioctl+0x1c4/0x1630
 [  291.279030] [<ffffffff81abe144>] SyS_ioctl+0x94/0xc0
 [  291.279030] [<ffffffff88147985>] entry_SYSCALL_64_fastpath+0x23/0xc6

Memory state around the buggy address:
 ffff880035d49080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff880035d49100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff880035d49180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                      ^
 ffff880035d49200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff880035d49280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Disabling lock debugging due to kernel taint
Disabled LAPIC found during irq injection