From: Dmitry Vyukov <dvyukov@google.com>
To: Alex Williamson <alex.williamson@redhat.com>,
Paolo Bonzini <pbonzini@redhat.com>,
KVM list <kvm@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Steve Rutherford <srutherford@google.com>
Cc: syzkaller <syzkaller@googlegroups.com>
Subject: kvm: use-after-free in irq_bypass_register_consumer
Date: Fri, 11 Nov 2016 21:12:13 -0800 [thread overview]
Message-ID: <CACT4Y+aA0ZVDP=pJkep3anzmwsKb7kTh5f33gPT6J3yyOEGeTA@mail.gmail.com> (raw)
Hello,
While running syzkaller fuzzer I got the following use-after-free report.
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11)
BUG: KASAN: use-after-free in irq_bypass_register_consumer+0x3d1/0x420
at addr ffff88003b5d8820
Write of size 8 by task syz-executor/25573
CPU: 0 PID: 25573 Comm: syz-executor Not tainted 4.9.0-rc4+ #46
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88006caaf9e0 ffffffff81c2d79b ffff88003e80ccc0 ffff88003b5d86b8
ffff88003b5d89f0 0000000000000001 ffff88006caafa08 ffffffff8165ab9c
ffffed00076bb104 ffffed00076bb104 ffff88003e80ccc0 ffff88006caafa88
Call Trace:
[<ffffffff8165b2b7>] __asan_report_store8_noabort+0x17/0x20
mm/kasan/report.c:334
[< inline >] list_add include/linux/list.h:43
[<ffffffff831d16d1>] irq_bypass_register_consumer+0x3d1/0x420
virt/lib/irqbypass.c:217
[< inline >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:417
[<ffffffff8106e3ea>] kvm_irqfd+0x109a/0x18a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
[<ffffffff81065797>] kvm_vm_ioctl+0x2e7/0x1670
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2996
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff816af6fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
[< inline >] SYSC_ioctl fs/ioctl.c:694
[<ffffffff816b063f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
[<ffffffff831e9dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Object at ffff88003b5d86b8, in cache kmalloc-512 size: 512
Allocated:
PID = 25573
[ 359.255946] [< inline >] kzalloc include/linux/slab.h:636
[ 359.255946] [< inline >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:296
[ 359.255946] [<ffffffff8106d3f7>] kvm_irqfd+0xa7/0x18a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
[ 359.255946] [<ffffffff81065797>] kvm_vm_ioctl+0x2e7/0x1670
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2996
[ 359.255946] [< inline >] vfs_ioctl fs/ioctl.c:43
[ 359.255946] [<ffffffff816af6fc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
[ 359.255946] [< inline >] SYSC_ioctl fs/ioctl.c:694
[ 359.255946] [<ffffffff816b063f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
[ 359.255946] [<ffffffff831e9dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 1057
[ 359.255946] [<ffffffff8165696a>] kfree+0xea/0x2c0 mm/slub.c:3871
[ 359.255946] [<ffffffff8106d16d>] irqfd_shutdown+0x13d/0x1a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:148
[ 359.255946] [<ffffffff8129175c>] process_one_work+0x9fc/0x1900
kernel/workqueue.c:2096
[ 359.255946] [<ffffffff8129274f>] worker_thread+0xef/0x1480
kernel/workqueue.c:2230
[ 359.386293] [<ffffffff812a5a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
[ 359.387074] [<ffffffff831ea02a>] ret_from_fork+0x2a/0x40
arch/x86/entry/entry_64.S:433
next reply other threads:[~2016-11-12 5:12 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-12 5:12 Dmitry Vyukov [this message]
-- strict thread matches above, loose matches on Subject: below --
2017-01-27 21:26 kvm: use-after-free in irq_bypass_register_consumer Dmitry Vyukov
2017-03-04 16:24 ` Dmitry Vyukov
2017-03-24 13:58 ` Dmitry Vyukov
2017-09-06 3:39 idaifish
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CACT4Y+aA0ZVDP=pJkep3anzmwsKb7kTh5f33gPT6J3yyOEGeTA@mail.gmail.com' \
--to=dvyukov@google.com \
--cc=alex.williamson@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=srutherford@google.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).