Groups > linux.kernel > #1520177

kvm: use-after-free in irq_bypass_register_consumer

Path	csiph.com!weretis.net!feeder4.news.weretis.net!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Dmitry Vyukov <dvyukov@google.com>
Newsgroups	linux.kernel
Subject	kvm: use-after-free in irq_bypass_register_consumer
Date	Sat, 12 Nov 2016 06:20:02 +0100
Message-ID	<sCyTo-653-5@gated-at.bofh.it> (permalink)
X-Original-To	Alex Williamson <alex.williamson@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, KVM list <kvm@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>, Steve Rutherford <srutherford@google.com>
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:from:date:message-id:subject:to:cc; bh=qDh1yBn0iUDWK/UWRT197QIYFCjjBl6NIPCn28mbFfA=; b=hPClLGNEolT1/unA5j0GI2ofeAItdTbEpE56C8VGgrd9GMhq75leIiv5+8IRLcKMAo fZUzdxi2VBA+IZOpHNcttXdnqCcOdudqH1HipMTDWv3DhvdacG4R7ecO+bIZq+XJO8i7 ejNY50qBGTeIVMBqMm/rAItc6//MTk04UBqSFam1qQpoXW1IhlEfmyc/pXq49Srv6EpL JLecjp5XoifnycRL9Vj1jUylBq0tnbQyURfy0tIHAyjTI9IUnYtGRr+VPLVGX9Rfn3Ji KOC+8AXLtUzARz7le4QJMTqqBxzSmBvmg2hzHcBhhgiFseaVLuasZQQ412duDpxZYgo/ NBfQ==
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=qDh1yBn0iUDWK/UWRT197QIYFCjjBl6NIPCn28mbFfA=; b=jsPEw785sSt7K3VRzI24y/nGtyAXBurv7VduSVMnrHkHX07pRwyePTnpNQnOGieVdc 0AdO2HiwJyx5UQbHVGEb0++JHbxrgxqx5tKwuGm563IMmoyLevxvUN2x0ImaFnxsyEh+ 9D+GwJUsn+2cVAfxvYvuWC4/qVfArw68afCb9l3JpwhK7psNNOJCuiJmp9HufbTpSAE0 C0uC6deFV8fHqMegJrvSBYdwEYeqfKi29VnbyjCqYNlYE/GX53E2bI/kHL6dR7cXd7H6 SyXqChZc7pke3ja4kzsQwsux4a3Yh5LtQNCumndvE/c2qEQtve03pr8wihuX01RFxlOR wtEg==
X-Gm-Message-State	ABUngvc3o36zEi0KmISBb8bhe4FeZCsv4RjB7vncZbT1QC9nHGvmjIAVI/wR0Kz5yNs0svD6uiG8k5p+H0PHUgQn
X-Received	by 10.55.88.70 with SMTP id m67mr6787280qkb.305.1478927553441; Fri, 11 Nov 2016 21:12:33 -0800 (PST)
MIME-Version	1.0
Content-Type	text/plain; charset=UTF-8
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	61
Organization	linux.* mail to news gateway
X-Original-Cc	syzkaller <syzkaller@googlegroups.com>
X-Original-Date	Fri, 11 Nov 2016 21:12:13 -0800
X-Original-Message-ID	<CACT4Y+aA0ZVDP=pJkep3anzmwsKb7kTh5f33gPT6J3yyOEGeTA@mail.gmail.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1520177

Show key headers only | View raw

Hello,

While running syzkaller fuzzer I got the following use-after-free report.
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11)


BUG: KASAN: use-after-free in irq_bypass_register_consumer+0x3d1/0x420
at addr ffff88003b5d8820
Write of size 8 by task syz-executor/25573
CPU: 0 PID: 25573 Comm: syz-executor Not tainted 4.9.0-rc4+ #46
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff88006caaf9e0 ffffffff81c2d79b ffff88003e80ccc0 ffff88003b5d86b8
 ffff88003b5d89f0 0000000000000001 ffff88006caafa08 ffffffff8165ab9c
 ffffed00076bb104 ffffed00076bb104 ffff88003e80ccc0 ffff88006caafa88
Call Trace:
 [<ffffffff8165b2b7>] __asan_report_store8_noabort+0x17/0x20
mm/kasan/report.c:334
 [<     inline     >] list_add include/linux/list.h:43
 [<ffffffff831d16d1>] irq_bypass_register_consumer+0x3d1/0x420
virt/lib/irqbypass.c:217
 [<     inline     >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:417
 [<ffffffff8106e3ea>] kvm_irqfd+0x109a/0x18a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
 [<ffffffff81065797>] kvm_vm_ioctl+0x2e7/0x1670
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2996
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff816af6fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
 [<     inline     >] SYSC_ioctl fs/ioctl.c:694
 [<ffffffff816b063f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff831e9dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2

Object at ffff88003b5d86b8, in cache kmalloc-512 size: 512

Allocated:
PID = 25573
 [  359.255946] [<     inline     >] kzalloc include/linux/slab.h:636
 [  359.255946] [<     inline     >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:296
 [  359.255946] [<ffffffff8106d3f7>] kvm_irqfd+0xa7/0x18a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
 [  359.255946] [<ffffffff81065797>] kvm_vm_ioctl+0x2e7/0x1670
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2996
 [  359.255946] [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [  359.255946] [<ffffffff816af6fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
 [  359.255946] [<     inline     >] SYSC_ioctl fs/ioctl.c:694
 [  359.255946] [<ffffffff816b063f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [  359.255946] [<ffffffff831e9dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2

Freed:
PID = 1057
 [  359.255946] [<ffffffff8165696a>] kfree+0xea/0x2c0 mm/slub.c:3871
 [  359.255946] [<ffffffff8106d16d>] irqfd_shutdown+0x13d/0x1a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:148
 [  359.255946] [<ffffffff8129175c>] process_one_work+0x9fc/0x1900
kernel/workqueue.c:2096
 [  359.255946] [<ffffffff8129274f>] worker_thread+0xef/0x1480
kernel/workqueue.c:2230
 [  359.386293] [<ffffffff812a5a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
 [  359.387074] [<ffffffff831ea02a>] ret_from_fork+0x2a/0x40
arch/x86/entry/entry_64.S:433

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

kvm: use-after-free in irq_bypass_register_consumer Dmitry Vyukov <dvyukov@google.com> - 2016-11-12 06:20 +0100

csiph-web