From: Sasha Levin <sasha.levin@oracle.com>
To: Gleb Natapov <gleb@kernel.org>, Paolo Bonzini <pbonzini@redhat.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Dmitry Vyukov <dvyukov@google.com>,
syzkaller <syzkaller@googlegroups.com>
Subject: kvm: access to invalid memory in mmu_zap_unsync_children
Date: Fri, 15 Jan 2016 11:54:16 -0500 [thread overview]
Message-ID: <56992438.6090804@oracle.com> (raw)
Hi all,
While fuzzing with syzkaller on the latest -next kernel running on a KVM tools
guest, I've hit the following invalid memory access:
[ 547.956284] UBSAN: Undefined behaviour in arch/x86/kvm/mmu.c:2011:17
[ 547.956940] index 3 is out of range for type 'kvm_mmu_page *[3]'
[ 547.957567] CPU: 0 PID: 21577 Comm: syz-executor Tainted: G D 4.4.0-next-20160114-sasha-00021-gf1273d1-dirty #2798
[ 547.958739] 1ffff1001819be5c 000000002fa0e55b ffff8800c0cdf360 ffffffff83433c4e
[ 547.972448] 0000000041b58ab3 ffffffff8f960c38 ffffffff83433b86 ffff8800c0cdf328
[ 547.973277] 0000000000000001 000000002fa0e55b ffffffff8feb8440 ffff8800c0cdf3f0
[ 547.974102] Call Trace:
[ 547.974424] dump_stack (lib/dump_stack.c:52)
[ 547.975774] ubsan_epilogue (lib/ubsan.c:165)
[ 547.976408] __ubsan_handle_out_of_bounds (lib/ubsan.c:382)
[ 547.980877] mmu_zap_unsync_children (arch/x86/kvm/mmu.c:2011 arch/x86/kvm/mmu.c:2272)
[ 548.014193] kvm_mmu_prepare_zap_page (arch/x86/kvm/mmu.c:2294)
[ 548.018228] kvm_mmu_invalidate_zap_all_pages (arch/x86/kvm/mmu.c:4737 arch/x86/kvm/mmu.c:4776)
[ 548.018994] kvm_arch_flush_shadow_all (arch/x86/kvm/x86.c:8050)
[ 548.019696] kvm_mmu_notifier_release (include/linux/rcupdate.h:495 include/linux/srcu.h:237 arch/x86/kvm/../../../virt/kvm/kvm_main.c:447)
[ 548.021657] __mmu_notifier_release (mm/mmu_notifier.c:66 (discriminator 19))
[ 548.024574] exit_mmap (include/linux/mmu_notifier.h:235 mm/mmap.c:2819)
[ 548.058887] mmput (kernel/fork.c:707)
[ 548.059572] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735)
[ 548.061733] do_group_exit (include/linux/sched.h:813 kernel/exit.c:861)
[ 548.062400] get_signal (kernel/signal.c:2327)
[ 548.063063] do_signal (arch/x86/kernel/signal.c:781)
[ 548.071394] exit_to_usermode_loop (arch/x86/entry/common.c:247)
[ 548.072066] syscall_return_slowpath (arch/x86/entry/common.c:282 arch/x86/entry/common.c:344)
[ 548.072824] int_ret_from_sys_call (arch/x86/entry/entry_64.S:282)
Thanks,
Sashagl
next reply other threads:[~2016-01-15 16:54 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-15 16:54 Sasha Levin [this message]
2016-01-15 17:06 ` kvm: access to invalid memory in mmu_zap_unsync_children Paolo Bonzini
2016-01-18 5:00 ` Xiao Guangrong
2016-01-18 6:25 ` Takuya Yoshikawa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56992438.6090804@oracle.com \
--to=sasha.levin@oracle.com \
--cc=dvyukov@google.com \
--cc=gleb@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.