From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1753883AbcAORGy (ORCPT <rfc822;w@1wt.eu>);
	Fri, 15 Jan 2016 12:06:54 -0500
Received: from mx1.redhat.com ([209.132.183.28]:57045 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751575AbcAORGx (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 15 Jan 2016 12:06:53 -0500
Subject: Re: kvm: access to invalid memory in mmu_zap_unsync_children
To: Sasha Levin <sasha.levin@oracle.com>, Gleb Natapov <gleb@kernel.org>
References: <56992438.6090804@oracle.com>
Cc: LKML <linux-kernel@vger.kernel.org>, Dmitry Vyukov <dvyukov@google.com>,
        syzkaller <syzkaller@googlegroups.com>,
        Marcelo Tosatti <mtosatti@redhat.com>,
        Takuya Yoshikawa <yoshikawa_takuya_b1@lab.ntt.co.jp>,
        Xiao Guangrong <guangrong.xiao@linux.intel.com>
From: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <56992719.9060004@redhat.com>
Date: Fri, 15 Jan 2016 18:06:33 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <56992438.6090804@oracle.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org



On 15/01/2016 17:54, Sasha Levin wrote:
> Hi all,
> 
> While fuzzing with syzkaller on the latest -next kernel running on a KVM tools
> guest, I've hit the following invalid memory access:
> 
> [  547.956284] UBSAN: Undefined behaviour in arch/x86/kvm/mmu.c:2011:17
> 
> [  547.956940] index 3 is out of range for type 'kvm_mmu_page *[3]'
> 
> [  547.957567] CPU: 0 PID: 21577 Comm: syz-executor Tainted: G      D         4.4.0-next-20160114-sasha-00021-gf1273d1-dirty #2798
> 
> [  547.958739]  1ffff1001819be5c 000000002fa0e55b ffff8800c0cdf360 ffffffff83433c4e
> 
> [  547.972448]  0000000041b58ab3 ffffffff8f960c38 ffffffff83433b86 ffff8800c0cdf328
> 
> [  547.973277]  0000000000000001 000000002fa0e55b ffffffff8feb8440 ffff8800c0cdf3f0
> 
> [  547.974102] Call Trace:
> 
> [  547.974424] dump_stack (lib/dump_stack.c:52)
> [  547.975774] ubsan_epilogue (lib/ubsan.c:165)
> [  547.976408] __ubsan_handle_out_of_bounds (lib/ubsan.c:382)
> [  547.980877] mmu_zap_unsync_children (arch/x86/kvm/mmu.c:2011 arch/x86/kvm/mmu.c:2272)

Marcelo/Takuya/Xiao,

do you know what's the point in the assignment in kvm_mmu_pages_init?

It seems to me that it should be

	parents->parent[0] = NULL;

since the only user of the ->parent[] array, mmu_pages_clear_parents,
walks the array up from parents->parent[0].

Any other opinions?

Paolo