From mboxrd@z Thu Jan 1 00:00:00 1970 From: christoffer.dall@linaro.org (Christoffer Dall) Date: Wed, 17 Feb 2016 10:15:14 +0100 Subject: [PATCH] KVM: arm/arm64: vgic: ensure bitmaps are long enough In-Reply-To: <56C33C1A.3090703@arm.com> References: <1455634051-1860-1-git-send-email-mark.rutland@arm.com> <56C33C1A.3090703@arm.com> Message-ID: <20160217091514.GA6696@cbox> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Tue, Feb 16, 2016 at 03:11:22PM +0000, Marc Zyngier wrote: > On 16/02/16 14:47, Mark Rutland wrote: > > When we allocate bitmaps in vgic_vcpu_init_maps, we divide the number of > > bits we need by 8 to figure out how many bytes to allocate. However, > > bitmap elements are always accessed as unsigned longs, and if we didn't > > happen to allocate a size such that size % sizeof(unsigned long) == 0, > > bitmap accesses may go past the end of the allocation. > > > > When using KASAN (which does byte-granular access checks), this results > > in a continuous stream of BUGs whenever these bitmaps are accessed: > > > > ============================================================================= > > BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected > > ----------------------------------------------------------------------------- > > > > INFO: Allocated in vgic_init.part.25+0x55c/0x990 age=7493 cpu=3 pid=1730 > > INFO: Slab 0xffffffbde6d5da40 objects=16 used=15 fp=0xffffffc935769700 flags=0x4000000000000080 > > INFO: Object 0xffffffc935769500 @offset=1280 fp=0x (null) > > > > Bytes b4 ffffffc9357694f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Object ffffffc935769500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Object ffffffc935769510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Object ffffffc935769520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Object ffffffc935769530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Object ffffffc935769540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Object ffffffc935769550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Object ffffffc935769560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Object ffffffc935769570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Padding ffffffc9357695b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Padding ffffffc9357695c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Padding ffffffc9357695d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Padding ffffffc9357695e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > Padding ffffffc9357695f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > > CPU: 3 PID: 1740 Comm: kvm-vcpu-0 Tainted: G B 4.4.0+ #17 > > Hardware name: ARM Juno development board (r1) (DT) > > Call trace: > > [] dump_backtrace+0x0/0x280 > > [] show_stack+0x14/0x20 > > [] dump_stack+0x100/0x188 > > [] print_trailer+0xfc/0x168 > > [] object_err+0x3c/0x50 > > [] kasan_report_error+0x244/0x558 > > [] __asan_report_load8_noabort+0x48/0x50 > > [] __bitmap_or+0xc0/0xc8 > > [] kvm_vgic_flush_hwstate+0x1bc/0x650 > > [] kvm_arch_vcpu_ioctl_run+0x2ec/0xa60 > > [] kvm_vcpu_ioctl+0x474/0xa68 > > [] do_vfs_ioctl+0x5b8/0xcb0 > > [] SyS_ioctl+0x8c/0xa0 > > [] el0_svc_naked+0x24/0x28 > > Memory state around the buggy address: > > ffffffc935769400: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ffffffc935769480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > >> ffffffc935769500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ^ > > ffffffc935769580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ffffffc935769600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc > > ================================================================== > > > > Fix the issue by always allocating a multiple of sizeof(unsigned long), > > as we do elsewhere in the vgic code. > > > > Signed-off-by: Mark Rutland > > Cc: Marc Zyngier > > Cc: Christoffer Dall > > --- > > virt/kvm/arm/vgic.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c > > index 7a2f449..5d10f10 100644 > > --- a/virt/kvm/arm/vgic.c > > +++ b/virt/kvm/arm/vgic.c > > @@ -1875,8 +1875,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu) > > static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs) > > { > > struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu; > > - > > - int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8; > > + int nr_longs = BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS); > > + int sz = nr_longs * sizeof(unsigned long); > > vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL); > > vgic_cpu->active_shared = kzalloc(sz, GFP_KERNEL); > > vgic_cpu->pend_act_shared = kzalloc(sz, GFP_KERNEL); > > > > Acked-by: Marc Zyngier > > Worth mentioning: > > Fixes: c1bfb577a ("arm/arm64: KVM: vgic: switch to dynamic allocation") > Cc: stable at vger.kernel.org > Thanks for this fix: Acked-by: Christoffer Dall