All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sasha.levin@oracle.com>
To: Paolo Bonzini <pbonzini@redhat.com>, Gleb Natapov <gleb@kernel.org>
Cc: LKML <linux-kernel@vger.kernel.org>,
	LKML <linux-kernel@vger.kernel.org>,
	Dmitry Vyukov <dvyukov@google.com>,
	syzkaller <syzkaller@googlegroups.com>
Subject: kvm: using uninitialized var in tdp_page_fault
Date: Fri, 15 Jan 2016 12:02:17 -0500	[thread overview]
Message-ID: <56992619.5030009@oracle.com> (raw)

Hi all,

While fuzzing with syzkaller on the latest -next kernel running on a KVM tools
guest, I've hit the following use of an uninitialized variable:

[  810.783676] UBSAN: Undefined behaviour in arch/x86/kvm/mmu.c:3502:6

[  810.785650] load of value 179 is not a valid value for type '_Bool'

[  810.787554] CPU: 2 PID: 24676 Comm: syz-executor Tainted: G      D         4.4.0-next-20160114-sasha-00021-gf1273d1-dirty #2798

[  810.790792]  1ffff10018213e84 000000008c6fa2f9 ffff8800c109f4a0 ffffffff83433c4e

[  810.792954]  0000000041b58ab3 ffffffff8f960c38 ffffffff83433b86 ffff8800c109f468

[  810.794776]  0000188300000001 000000008c6fa2f9 ffffffff8feb7a20 ffff8800c109f530

[  810.796001] Call Trace:

[  810.796840] dump_stack (lib/dump_stack.c:52)
[  810.798243] ubsan_epilogue (lib/ubsan.c:165)
[  810.802976] __ubsan_handle_load_invalid_value (lib/ubsan.c:454)
[  810.806657] tdp_page_fault (arch/x86/kvm/mmu.c:3502)
[  810.809900] kvm_mmu_page_fault (arch/x86/kvm/mmu.c:4372)
[  810.810517] handle_ept_violation (arch/x86/kvm/vmx.c:5961)
[  810.812386] vmx_handle_exit (arch/x86/kvm/vmx.c:8183)
[  810.817389] vcpu_enter_guest (arch/x86/kvm/x86.c:6677)
[  810.831863] kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:6741 arch/x86/kvm/x86.c:6894)
[  810.834138] kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:2365)
[  810.840570] do_vfs_ioctl (fs/ioctl.c:44 fs/ioctl.c:674)
[  810.855017] SyS_ioctl (fs/ioctl.c:689 fs/ioctl.c:680)
[  810.856134] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)

             reply	other threads:[~2016-01-15 17:02 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-15 17:02 Sasha Levin [this message]
2016-02-23 14:30 ` kvm: using uninitialized var in tdp_page_fault Paolo Bonzini
2016-02-28 13:08   ` Dmitry Vyukov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=56992619.5030009@oracle.com \
    --to=sasha.levin@oracle.com \
    --cc=dvyukov@google.com \
    --cc=gleb@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pbonzini@redhat.com \
    --cc=syzkaller@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.