* [PATCH] kvm: avoid NULL pointer deref in kvm_write_guest_virt_system
@ 2019-10-07 11:57 Jack Wang
2019-10-07 12:04 ` Paolo Bonzini
0 siblings, 1 reply; 3+ messages in thread
From: Jack Wang @ 2019-10-07 11:57 UTC (permalink / raw)
To: pbonzini, rkrcmar, sean.j.christopherson, vkuznets, wanpengli,
jmattson, joro, tglx, x86, kvm
Cc: Jack Wang
From: Jack Wang <jinpu.wang@cloud.ionos.com>
kvm-unit-test triggered a NULL pointer deref below:
[ 948.518437] kvm [24114]: vcpu0, guest rIP: 0x407ef9 kvm_set_msr_common: MSR_IA32_DEBUGCTLMSR 0x3, nop
[ 949.106464] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[ 949.106707] PGD 0 P4D 0
[ 949.106872] Oops: 0002 [#1] SMP
[ 949.107038] CPU: 2 PID: 24126 Comm: qemu-2.7 Not tainted 4.19.77-pserver #4.19.77-1+feature+daily+update+20191005.1625+a4168bb~deb9
[ 949.107283] Hardware name: Dell Inc. Precision Tower 3620/09WH54, BIOS 2.7.3 01/31/2018
[ 949.107549] RIP: 0010:kvm_write_guest_virt_system+0x12/0x40 [kvm]
[ 949.107719] Code: c0 5d 41 5c 41 5d 41 5e 83 f8 03 41 0f 94 c0 41 c1 e0 02 e9 b0 ed ff ff 0f 1f 44 00 00 48 89 f0 c6 87 59 56 00 00 01 48 89 d6 <49> c7 00 00 00 00 00 89 ca 49 c7 40 08 00 00 00 00 49 c7 40 10 00
[ 949.108044] RSP: 0018:ffffb31b0a953cb0 EFLAGS: 00010202
[ 949.108216] RAX: 000000000046b4d8 RBX: ffff9e9f415b0000 RCX: 0000000000000008
[ 949.108389] RDX: ffffb31b0a953cc0 RSI: ffffb31b0a953cc0 RDI: ffff9e9f415b0000
[ 949.108562] RBP: 00000000d2e14928 R08: 0000000000000000 R09: 0000000000000000
[ 949.108733] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffffffffc8
[ 949.108907] R13: 0000000000000002 R14: ffff9e9f4f26f2e8 R15: 0000000000000000
[ 949.109079] FS: 00007eff8694c700(0000) GS:ffff9e9f51a80000(0000) knlGS:0000000031415928
[ 949.109318] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 949.109495] CR2: 0000000000000000 CR3: 00000003be53b002 CR4: 00000000003626e0
[ 949.109671] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 949.109845] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 949.110017] Call Trace:
[ 949.110186] handle_vmread+0x22b/0x2f0 [kvm_intel]
[ 949.110356] ? vmexit_fill_RSB+0xc/0x30 [kvm_intel]
[ 949.110549] kvm_arch_vcpu_ioctl_run+0xa98/0x1b30 [kvm]
[ 949.110725] ? kvm_vcpu_ioctl+0x388/0x5d0 [kvm]
[ 949.110901] kvm_vcpu_ioctl+0x388/0x5d0 [kvm]
[ 949.111072] do_vfs_ioctl+0xa2/0x620
The commit introduced the bug is 541ab2aeb282, it has been backported to
at least stable 4.14.145+ and 4.19.74+, to fix it, just check the
exception not NULL before do the memset. The fix should go to stable.
Fixes: 541ab2aeb282 ("KVM: x86: work around leak of uninitialized stack contents")
Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
---
I did the kvm-unit-tests on top of 4.19.77, it no longer crash with the fix,
and it applies cleanly to v5.4-rc2.
---
arch/x86/kvm/x86.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 661e2bf38526..9fd734fcacb5 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5438,7 +5438,8 @@ int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val,
* call kvm_inject_page_fault. Ensure that they at least do not leak
* uninitialized kernel stack memory into cr2 and error code.
*/
- memset(exception, 0, sizeof(*exception));
+ if (exception)
+ memset(exception, 0, sizeof(*exception));
return kvm_write_guest_virt_helper(addr, val, bytes, vcpu,
PFERR_WRITE_MASK, exception);
}
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] kvm: avoid NULL pointer deref in kvm_write_guest_virt_system
2019-10-07 11:57 [PATCH] kvm: avoid NULL pointer deref in kvm_write_guest_virt_system Jack Wang
@ 2019-10-07 12:04 ` Paolo Bonzini
2019-10-07 12:18 ` Jinpu Wang
0 siblings, 1 reply; 3+ messages in thread
From: Paolo Bonzini @ 2019-10-07 12:04 UTC (permalink / raw)
To: Jack Wang, rkrcmar, sean.j.christopherson, vkuznets, wanpengli,
jmattson, joro, tglx, x86, kvm
Cc: Jack Wang
On 07/10/19 13:57, Jack Wang wrote:
> From: Jack Wang <jinpu.wang@cloud.ionos.com>
>
> kvm-unit-test triggered a NULL pointer deref below:
> [ 948.518437] kvm [24114]: vcpu0, guest rIP: 0x407ef9 kvm_set_msr_common: MSR_IA32_DEBUGCTLMSR 0x3, nop
> [ 949.106464] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
> [ 949.106707] PGD 0 P4D 0
> [ 949.106872] Oops: 0002 [#1] SMP
> [ 949.107038] CPU: 2 PID: 24126 Comm: qemu-2.7 Not tainted 4.19.77-pserver #4.19.77-1+feature+daily+update+20191005.1625+a4168bb~deb9
> [ 949.107283] Hardware name: Dell Inc. Precision Tower 3620/09WH54, BIOS 2.7.3 01/31/2018
> [ 949.107549] RIP: 0010:kvm_write_guest_virt_system+0x12/0x40 [kvm]
> [ 949.107719] Code: c0 5d 41 5c 41 5d 41 5e 83 f8 03 41 0f 94 c0 41 c1 e0 02 e9 b0 ed ff ff 0f 1f 44 00 00 48 89 f0 c6 87 59 56 00 00 01 48 89 d6 <49> c7 00 00 00 00 00 89 ca 49 c7 40 08 00 00 00 00 49 c7 40 10 00
> [ 949.108044] RSP: 0018:ffffb31b0a953cb0 EFLAGS: 00010202
> [ 949.108216] RAX: 000000000046b4d8 RBX: ffff9e9f415b0000 RCX: 0000000000000008
> [ 949.108389] RDX: ffffb31b0a953cc0 RSI: ffffb31b0a953cc0 RDI: ffff9e9f415b0000
> [ 949.108562] RBP: 00000000d2e14928 R08: 0000000000000000 R09: 0000000000000000
> [ 949.108733] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffffffffc8
> [ 949.108907] R13: 0000000000000002 R14: ffff9e9f4f26f2e8 R15: 0000000000000000
> [ 949.109079] FS: 00007eff8694c700(0000) GS:ffff9e9f51a80000(0000) knlGS:0000000031415928
> [ 949.109318] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 949.109495] CR2: 0000000000000000 CR3: 00000003be53b002 CR4: 00000000003626e0
> [ 949.109671] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 949.109845] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 949.110017] Call Trace:
> [ 949.110186] handle_vmread+0x22b/0x2f0 [kvm_intel]
> [ 949.110356] ? vmexit_fill_RSB+0xc/0x30 [kvm_intel]
> [ 949.110549] kvm_arch_vcpu_ioctl_run+0xa98/0x1b30 [kvm]
> [ 949.110725] ? kvm_vcpu_ioctl+0x388/0x5d0 [kvm]
> [ 949.110901] kvm_vcpu_ioctl+0x388/0x5d0 [kvm]
> [ 949.111072] do_vfs_ioctl+0xa2/0x620
>
> The commit introduced the bug is 541ab2aeb282, it has been backported to
> at least stable 4.14.145+ and 4.19.74+, to fix it, just check the
> exception not NULL before do the memset. The fix should go to stable.
>
> Fixes: 541ab2aeb282 ("KVM: x86: work around leak of uninitialized stack contents")
> Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
Hi Jack,
instead of this, commit f7eea636c3d5 ("KVM: nVMX: handle page fault in
vmread", 2019-09-14) should be backported to stable.
Thanks,
Paolo
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] kvm: avoid NULL pointer deref in kvm_write_guest_virt_system
2019-10-07 12:04 ` Paolo Bonzini
@ 2019-10-07 12:18 ` Jinpu Wang
0 siblings, 0 replies; 3+ messages in thread
From: Jinpu Wang @ 2019-10-07 12:18 UTC (permalink / raw)
To: Paolo Bonzini
Cc: Jack Wang, Radim Krčmář,
Sean Christopherson, vkuznets, wanpengli, Jim Mattson,
Joerg Roedel, Thomas Gleixner, x86, kvm
On Mon, Oct 7, 2019 at 2:04 PM Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> On 07/10/19 13:57, Jack Wang wrote:
> > From: Jack Wang <jinpu.wang@cloud.ionos.com>
> >
> > kvm-unit-test triggered a NULL pointer deref below:
> > [ 948.518437] kvm [24114]: vcpu0, guest rIP: 0x407ef9 kvm_set_msr_common: MSR_IA32_DEBUGCTLMSR 0x3, nop
> > [ 949.106464] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
> > [ 949.106707] PGD 0 P4D 0
> > [ 949.106872] Oops: 0002 [#1] SMP
> > [ 949.107038] CPU: 2 PID: 24126 Comm: qemu-2.7 Not tainted 4.19.77-pserver #4.19.77-1+feature+daily+update+20191005.1625+a4168bb~deb9
> > [ 949.107283] Hardware name: Dell Inc. Precision Tower 3620/09WH54, BIOS 2.7.3 01/31/2018
> > [ 949.107549] RIP: 0010:kvm_write_guest_virt_system+0x12/0x40 [kvm]
> > [ 949.107719] Code: c0 5d 41 5c 41 5d 41 5e 83 f8 03 41 0f 94 c0 41 c1 e0 02 e9 b0 ed ff ff 0f 1f 44 00 00 48 89 f0 c6 87 59 56 00 00 01 48 89 d6 <49> c7 00 00 00 00 00 89 ca 49 c7 40 08 00 00 00 00 49 c7 40 10 00
> > [ 949.108044] RSP: 0018:ffffb31b0a953cb0 EFLAGS: 00010202
> > [ 949.108216] RAX: 000000000046b4d8 RBX: ffff9e9f415b0000 RCX: 0000000000000008
> > [ 949.108389] RDX: ffffb31b0a953cc0 RSI: ffffb31b0a953cc0 RDI: ffff9e9f415b0000
> > [ 949.108562] RBP: 00000000d2e14928 R08: 0000000000000000 R09: 0000000000000000
> > [ 949.108733] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffffffffc8
> > [ 949.108907] R13: 0000000000000002 R14: ffff9e9f4f26f2e8 R15: 0000000000000000
> > [ 949.109079] FS: 00007eff8694c700(0000) GS:ffff9e9f51a80000(0000) knlGS:0000000031415928
> > [ 949.109318] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [ 949.109495] CR2: 0000000000000000 CR3: 00000003be53b002 CR4: 00000000003626e0
> > [ 949.109671] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > [ 949.109845] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > [ 949.110017] Call Trace:
> > [ 949.110186] handle_vmread+0x22b/0x2f0 [kvm_intel]
> > [ 949.110356] ? vmexit_fill_RSB+0xc/0x30 [kvm_intel]
> > [ 949.110549] kvm_arch_vcpu_ioctl_run+0xa98/0x1b30 [kvm]
> > [ 949.110725] ? kvm_vcpu_ioctl+0x388/0x5d0 [kvm]
> > [ 949.110901] kvm_vcpu_ioctl+0x388/0x5d0 [kvm]
> > [ 949.111072] do_vfs_ioctl+0xa2/0x620
> >
> > The commit introduced the bug is 541ab2aeb282, it has been backported to
> > at least stable 4.14.145+ and 4.19.74+, to fix it, just check the
> > exception not NULL before do the memset. The fix should go to stable.
> >
> > Fixes: 541ab2aeb282 ("KVM: x86: work around leak of uninitialized stack contents")
> > Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
>
> Hi Jack,
>
> instead of this, commit f7eea636c3d5 ("KVM: nVMX: handle page fault in
> vmread", 2019-09-14) should be backported to stable.
Ok, just checked looks it's a mistake during backport, I will send a
fix only to stable.
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.19.y&id=73c31bd920393be70bb30a0b7c6e9c47990c3d3a
>
> Thanks,
>
> Paolo
Thanks,
Jack
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-10-07 12:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-07 11:57 [PATCH] kvm: avoid NULL pointer deref in kvm_write_guest_virt_system Jack Wang
2019-10-07 12:04 ` Paolo Bonzini
2019-10-07 12:18 ` Jinpu Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).