From: Sasha Levin <sasha.levin@oracle.com>
To: Gleb Natapov <gleb@kernel.org>, Paolo Bonzini <pbonzini@redhat.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Dmitry Vyukov <dvyukov@google.com>,
syzkaller <syzkaller@googlegroups.com>
Subject: kvm: access to invalid memory in mmu_zap_unsync_children
Date: Fri, 15 Jan 2016 11:54:16 -0500 [thread overview]
Message-ID: <56992438.6090804@oracle.com> (raw)
Hi all,
While fuzzing with syzkaller on the latest -next kernel running on a KVM tools
guest, I've hit the following invalid memory access:
[ 547.956284] UBSAN: Undefined behaviour in arch/x86/kvm/mmu.c:2011:17
[ 547.956940] index 3 is out of range for type 'kvm_mmu_page *[3]'
[ 547.957567] CPU: 0 PID: 21577 Comm: syz-executor Tainted: G D 4.4.0-next-20160114-sasha-00021-gf1273d1-dirty #2798
[ 547.958739] 1ffff1001819be5c 000000002fa0e55b ffff8800c0cdf360 ffffffff83433c4e
[ 547.972448] 0000000041b58ab3 ffffffff8f960c38 ffffffff83433b86 ffff8800c0cdf328
[ 547.973277] 0000000000000001 000000002fa0e55b ffffffff8feb8440 ffff8800c0cdf3f0
[ 547.974102] Call Trace:
[ 547.974424] dump_stack (lib/dump_stack.c:52)
[ 547.975774] ubsan_epilogue (lib/ubsan.c:165)
[ 547.976408] __ubsan_handle_out_of_bounds (lib/ubsan.c:382)
[ 547.980877] mmu_zap_unsync_children (arch/x86/kvm/mmu.c:2011 arch/x86/kvm/mmu.c:2272)
[ 548.014193] kvm_mmu_prepare_zap_page (arch/x86/kvm/mmu.c:2294)
[ 548.018228] kvm_mmu_invalidate_zap_all_pages (arch/x86/kvm/mmu.c:4737 arch/x86/kvm/mmu.c:4776)
[ 548.018994] kvm_arch_flush_shadow_all (arch/x86/kvm/x86.c:8050)
[ 548.019696] kvm_mmu_notifier_release (include/linux/rcupdate.h:495 include/linux/srcu.h:237 arch/x86/kvm/../../../virt/kvm/kvm_main.c:447)
[ 548.021657] __mmu_notifier_release (mm/mmu_notifier.c:66 (discriminator 19))
[ 548.024574] exit_mmap (include/linux/mmu_notifier.h:235 mm/mmap.c:2819)
[ 548.058887] mmput (kernel/fork.c:707)
[ 548.059572] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735)
[ 548.061733] do_group_exit (include/linux/sched.h:813 kernel/exit.c:861)
[ 548.062400] get_signal (kernel/signal.c:2327)
[ 548.063063] do_signal (arch/x86/kernel/signal.c:781)
[ 548.071394] exit_to_usermode_loop (arch/x86/entry/common.c:247)
[ 548.072066] syscall_return_slowpath (arch/x86/entry/common.c:282 arch/x86/entry/common.c:344)
[ 548.072824] int_ret_from_sys_call (arch/x86/entry/entry_64.S:282)
Thanks,
Sashagl
next reply other threads:[~2016-01-15 16:54 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-15 16:54 Sasha Levin [this message]
2016-01-15 17:06 ` kvm: access to invalid memory in mmu_zap_unsync_children Paolo Bonzini
2016-01-18 5:00 ` Xiao Guangrong
2016-01-18 6:25 ` Takuya Yoshikawa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56992438.6090804@oracle.com \
--to=sasha.levin@oracle.com \
--cc=dvyukov@google.com \
--cc=gleb@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox