From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753787AbcAOQy3 (ORCPT ); Fri, 15 Jan 2016 11:54:29 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:36461 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750769AbcAOQy2 (ORCPT ); Fri, 15 Jan 2016 11:54:28 -0500 From: Sasha Levin X-Enigmail-Draft-Status: N1110 To: Gleb Natapov , Paolo Bonzini Cc: LKML , LKML , Dmitry Vyukov , syzkaller Subject: kvm: access to invalid memory in mmu_zap_unsync_children Message-ID: <56992438.6090804@oracle.com> Date: Fri, 15 Jan 2016 11:54:16 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi all, While fuzzing with syzkaller on the latest -next kernel running on a KVM tools guest, I've hit the following invalid memory access: [ 547.956284] UBSAN: Undefined behaviour in arch/x86/kvm/mmu.c:2011:17 [ 547.956940] index 3 is out of range for type 'kvm_mmu_page *[3]' [ 547.957567] CPU: 0 PID: 21577 Comm: syz-executor Tainted: G D 4.4.0-next-20160114-sasha-00021-gf1273d1-dirty #2798 [ 547.958739] 1ffff1001819be5c 000000002fa0e55b ffff8800c0cdf360 ffffffff83433c4e [ 547.972448] 0000000041b58ab3 ffffffff8f960c38 ffffffff83433b86 ffff8800c0cdf328 [ 547.973277] 0000000000000001 000000002fa0e55b ffffffff8feb8440 ffff8800c0cdf3f0 [ 547.974102] Call Trace: [ 547.974424] dump_stack (lib/dump_stack.c:52) [ 547.975774] ubsan_epilogue (lib/ubsan.c:165) [ 547.976408] __ubsan_handle_out_of_bounds (lib/ubsan.c:382) [ 547.980877] mmu_zap_unsync_children (arch/x86/kvm/mmu.c:2011 arch/x86/kvm/mmu.c:2272) [ 548.014193] kvm_mmu_prepare_zap_page (arch/x86/kvm/mmu.c:2294) [ 548.018228] kvm_mmu_invalidate_zap_all_pages (arch/x86/kvm/mmu.c:4737 arch/x86/kvm/mmu.c:4776) [ 548.018994] kvm_arch_flush_shadow_all (arch/x86/kvm/x86.c:8050) [ 548.019696] kvm_mmu_notifier_release (include/linux/rcupdate.h:495 include/linux/srcu.h:237 arch/x86/kvm/../../../virt/kvm/kvm_main.c:447) [ 548.021657] __mmu_notifier_release (mm/mmu_notifier.c:66 (discriminator 19)) [ 548.024574] exit_mmap (include/linux/mmu_notifier.h:235 mm/mmap.c:2819) [ 548.058887] mmput (kernel/fork.c:707) [ 548.059572] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735) [ 548.061733] do_group_exit (include/linux/sched.h:813 kernel/exit.c:861) [ 548.062400] get_signal (kernel/signal.c:2327) [ 548.063063] do_signal (arch/x86/kernel/signal.c:781) [ 548.071394] exit_to_usermode_loop (arch/x86/entry/common.c:247) [ 548.072066] syscall_return_slowpath (arch/x86/entry/common.c:282 arch/x86/entry/common.c:344) [ 548.072824] int_ret_from_sys_call (arch/x86/entry/entry_64.S:282) Thanks, Sashagl