linux-kernel - Re: [PATCH] KVM: x86: fix out-of-bounds accesses of rtc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <573e8431-a7fb-fc53-9e04-7007058fe1c9@redhat.com>
Date:   Thu, 24 Nov 2016 12:49:56 +0100
From:   David Hildenbrand <david@...hat.com>
To:     Radim Krčmář <rkrcmar@...hat.com>,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Cc:     Paolo Bonzini <pbonzini@...hat.com>, stable@...r.kernel.org,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Steve Rutherford <srutherford@...gle.com>
Subject: Re: [PATCH] KVM: x86: fix out-of-bounds accesses of rtc_eoi map

Am 23.11.2016 um 21:15 schrieb Radim Krčmář:
> KVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be
> bigger that the maximal number of VCPUs, resulting in out-of-bounds
> access.
>
> Found by syzkaller:
>
>   BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr [...]
>   Write of size 1 by task a.out/27101
>   CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49
>   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>    [...]
>   Call Trace:
>    [...] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905
>    [...] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495
>    [...] kvm_irq_delivery_to_apic+0x732/0xc10 arch/x86/kvm/irq_comm.c:86
>    [...] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360
>    [...] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222
>    [...] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235
>    [...] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670
>    [...] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668
>    [...] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999
>    [...] kvm_vm_ioctl+0x1fa/0x1a70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099
>
> Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
> Cc: stable@...r.kernel.org
> Fixes: af1bae5497b9 ("KVM: x86: bump KVM_MAX_VCPU_ID to 1023")
> Signed-off-by: Radim Krčmář <rkrcmar@...hat.com>
> ---
> Cc: Dmitry Vyukov <dvyukov@...gle.com>
> Cc: Steve Rutherford <srutherford@...gle.com>
> ---

Yes, the array and the bitmap are always accessed using vcpu_id, so this 
is correct.

Reviewed-by: David Hildenbrand <david@...hat.com>

-- 

David