lkml.org 
[lkml]   [2016]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] KVM: x86: fix out-of-bounds accesses of rtc_eoi map
From
Date
Am 23.11.2016 um 21:15 schrieb Radim Krčmář:
> KVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be
> bigger that the maximal number of VCPUs, resulting in out-of-bounds
> access.
>
> Found by syzkaller:
>
> BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr [...]
> Write of size 1 by task a.out/27101
> CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> [...]
> Call Trace:
> [...] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905
> [...] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495
> [...] kvm_irq_delivery_to_apic+0x732/0xc10 arch/x86/kvm/irq_comm.c:86
> [...] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360
> [...] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222
> [...] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235
> [...] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670
> [...] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668
> [...] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999
> [...] kvm_vm_ioctl+0x1fa/0x1a70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099
>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Cc: stable@vger.kernel.org
> Fixes: af1bae5497b9 ("KVM: x86: bump KVM_MAX_VCPU_ID to 1023")
> Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
> ---
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Steve Rutherford <srutherford@google.com>
> ---

Yes, the array and the bitmap are always accessed using vcpu_id, so this
is correct.

Reviewed-by: David Hildenbrand <david@redhat.com>

--

David

\
 
 \ /
  Last update: 2016-11-24 13:26    [W:0.165 / U:0.124 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site