linux-kernel - Re: [Syzkaller & bisect] There was "iommufd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 28 Feb 2023 11:11:06 +0800
From:   Pengfei Xu <pengfei.xu@...el.com>
To:     Jason Gunthorpe <jgg@...pe.ca>
CC:     <baolu.lu@...el.com>, <yi.l.liu@...el.com>, <kevin.tian@...el.com>,
        <heng.su@...el.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [Syzkaller & bisect] There was "iommufd_test" WARNING in v6.2 in
 guest

Hi Jason,

On 2023-02-27 at 14:03:56 +0800, Pengfei Xu wrote:
> Hi Jason,
> 
> On 2023-02-24 at 10:48:45 -0400, Jason Gunthorpe wrote:
> > On Fri, Feb 24, 2023 at 01:43:38PM +0800, Pengfei Xu wrote:
> > > Hi Jason,
> > > 
> > > Greeting!
> > > 
> > > Platform: ADL-S and x86 platforms
> > > Host kernel 6.2.0-rc7 which doesn't enable iommufd by host kconfig setting as
> > > below:
> > > "# CONFIG_IOMMUFD is not set"
> > > 
> > > Guest kconfig with iommufd enabled: https://github.com/xupengfe/syzkaller_logs/blob/main/230224_044002_iommufd_test/kconfig_origin
> > > Reproduced code: https://github.com/xupengfe/syzkaller_logs/blob/main/230224_044002_iommufd_test/repro.c
> > > v6.2 problem dmesg: https://github.com/xupengfe/syzkaller_logs/blob/main/230224_044002_iommufd_test/v6.2_c9c3395d5e3dcc6daee66c6908354d47bf98cb0c_dmesg.log
> > > Bisect info: https://github.com/xupengfe/syzkaller_logs/blob/main/230224_044002_iommufd_test/bisect_info.log
> > > 
> > > There was "iommufd_test" WARNING in v6.2 in guest:
> > > [   32.012827] ------------[ cut here ]------------
> > > [   32.013027] WARNING: CPU: 1 PID: 393 at drivers/iommu/iommufd/selftest.c:403 iommufd_test+0xb19/0x16f0
> > > [   32.013410] Modules linked in:
> > 
> > I didn't include the IOMMU_TEST_OP_MD_CHECK_REFS in the syzkaller
> > descriptions, how did you hit this?
> > 
> I am new to iommufd feature, and I'm not sure how syzkaller got to this
> unexpected test point.
> 
> Anyway, I provided syzkaller repo top commit id info on that ADL-S:
> commit bcdf85f8bd3fccff5bc9507a589c4847d9b35405 (HEAD -> master)
> Author: Dmitry Vyukov <dvyukov@...gle.com>
> Date:   Fri Feb 17 09:58:24 2023 +0100
>     dashboard/config/linux: enable DWARF4 for all
> 
> And I didn't change the file "syzkaller/sys/linux/dev_iommu.txt.const":
...

> 
> > Anyhow, it is a small issue in the test suite because uptr + length overflows:
> > 
>   Thanks a lot for your patch! I'm glad it's helpful.
> 
>   Thanks!
>   BR.
> 
> > --- a/drivers/iommu/iommufd/selftest.c
> > +++ b/drivers/iommu/iommufd/selftest.c
> > @@ -568,13 +568,17 @@ static int iommufd_test_md_check_refs(struct iommufd_ucmd *ucmd,
> >                                       void __user *uptr, size_t length,
> >                                       unsigned int refs)
> >  {
> > -       if (length % PAGE_SIZE || (uintptr_t)uptr % PAGE_SIZE)
> > +       uintptr_t end;
> > +
> > +       if (length % PAGE_SIZE || (uintptr_t)uptr % PAGE_SIZE ||
> > +           check_add_overflow((uintptr_t)uptr, (uintptr_t)length, &end))
> >                 return -EINVAL;
> > 
 I tested above patch on top of v6.2 kernel, there was no iommufd_test issue.
 This issue was fixed.
 Attached is the fixed dmesg log.

 Thanks!
 BR.

> > Jason

View attachment "v6.2_iommufd_test_fixed.log" of type "text/plain" (112320 bytes)