linux-kernel - Re: [syzbot] WARNING: kmalloc bug in memslot_rmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 8 Sep 2021 07:36:02 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Sean Christopherson <seanjc@...gle.com>,
        syzbot <syzbot+e0de2333cbf95ea473e8@...kaller.appspotmail.com>
Cc:     bp@...en8.de, dave.hansen@...ux.intel.com, hpa@...or.com,
        jarkko@...nel.org, jmattson@...gle.com, joro@...tes.org,
        kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-sgx@...r.kernel.org, mingo@...hat.com,
        syzkaller-bugs@...glegroups.com, tglx@...utronix.de,
        vkuznets@...hat.com, wanpengli@...cent.com, x86@...nel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Ben Gardon <bgardon@...gle.com>
Subject: Re: [syzbot] WARNING: kmalloc bug in memslot_rmap_alloc

On 07/09/21 19:30, Sean Christopherson wrote:
> The allocation in question is for KVM's "rmap" to translate a guest pfn to a host
> virtual address.  The size of the rmap in question is an unsigned long per 4kb page
> in a memslot, i.e. on x86-64, 8 bytes per 4096 bytes of guest memory in a memslot.
> With INT_MAX=0x7fffffff, KVM will trip the WARN and fail rmap allocations for
> memslots >= 1tb, and Google already has VMs that create 1.5tb memslots (12tb of
> total guest memory spread across 8 virtual NUMA nodes).

We can just use vmalloc.  The warning was only added on kvmalloc, and 
vmalloc suits the KVM rmap just fine.

The maximum that Red Hat has tested, as far as I know, is about 4TiB 
(and it was back when there was no support for virtual NUMA nodes in 
QEMU, so it was all in a single memslot).

Paolo