* [PATCH] KVM: arm/arm64: vgic: ensure bitmaps are long enough
@ 2016-02-16 14:47 ` Mark Rutland
0 siblings, 0 replies; 6+ messages in thread
From: Mark Rutland @ 2016-02-16 14:47 UTC (permalink / raw)
To: kvmarm
Cc: kvm, linux-arm-kernel, Mark Rutland, Marc Zyngier, Christoffer Dall
When we allocate bitmaps in vgic_vcpu_init_maps, we divide the number of
bits we need by 8 to figure out how many bytes to allocate. However,
bitmap elements are always accessed as unsigned longs, and if we didn't
happen to allocate a size such that size % sizeof(unsigned long) == 0,
bitmap accesses may go past the end of the allocation.
When using KASAN (which does byte-granular access checks), this results
in a continuous stream of BUGs whenever these bitmaps are accessed:
=============================================================================
BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in vgic_init.part.25+0x55c/0x990 age=7493 cpu=3 pid=1730
INFO: Slab 0xffffffbde6d5da40 objects=16 used=15 fp=0xffffffc935769700 flags=0x4000000000000080
INFO: Object 0xffffffc935769500 @offset=1280 fp=0x (null)
Bytes b4 ffffffc9357694f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CPU: 3 PID: 1740 Comm: kvm-vcpu-0 Tainted: G B 4.4.0+ #17
Hardware name: ARM Juno development board (r1) (DT)
Call trace:
[<ffffffc00008e770>] dump_backtrace+0x0/0x280
[<ffffffc00008ea04>] show_stack+0x14/0x20
[<ffffffc000726360>] dump_stack+0x100/0x188
[<ffffffc00030d324>] print_trailer+0xfc/0x168
[<ffffffc000312294>] object_err+0x3c/0x50
[<ffffffc0003140fc>] kasan_report_error+0x244/0x558
[<ffffffc000314548>] __asan_report_load8_noabort+0x48/0x50
[<ffffffc000745688>] __bitmap_or+0xc0/0xc8
[<ffffffc0000d9e44>] kvm_vgic_flush_hwstate+0x1bc/0x650
[<ffffffc0000c514c>] kvm_arch_vcpu_ioctl_run+0x2ec/0xa60
[<ffffffc0000b9a6c>] kvm_vcpu_ioctl+0x474/0xa68
[<ffffffc00036b7b0>] do_vfs_ioctl+0x5b8/0xcb0
[<ffffffc00036bf34>] SyS_ioctl+0x8c/0xa0
[<ffffffc000086cb0>] el0_svc_naked+0x24/0x28
Memory state around the buggy address:
ffffffc935769400: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffffc935769480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffffffc935769500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffffffc935769580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffffc935769600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Fix the issue by always allocating a multiple of sizeof(unsigned long),
as we do elsewhere in the vgic code.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Christoffer Dall <christoffer.dall@linaro.org>
---
virt/kvm/arm/vgic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 7a2f449..5d10f10 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1875,8 +1875,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
{
struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
-
- int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
+ int nr_longs = BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS);
+ int sz = nr_longs * sizeof(unsigned long);
vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
vgic_cpu->active_shared = kzalloc(sz, GFP_KERNEL);
vgic_cpu->pend_act_shared = kzalloc(sz, GFP_KERNEL);
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH] KVM: arm/arm64: vgic: ensure bitmaps are long enough
@ 2016-02-16 14:47 ` Mark Rutland
0 siblings, 0 replies; 6+ messages in thread
From: Mark Rutland @ 2016-02-16 14:47 UTC (permalink / raw)
To: linux-arm-kernel
When we allocate bitmaps in vgic_vcpu_init_maps, we divide the number of
bits we need by 8 to figure out how many bytes to allocate. However,
bitmap elements are always accessed as unsigned longs, and if we didn't
happen to allocate a size such that size % sizeof(unsigned long) == 0,
bitmap accesses may go past the end of the allocation.
When using KASAN (which does byte-granular access checks), this results
in a continuous stream of BUGs whenever these bitmaps are accessed:
=============================================================================
BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in vgic_init.part.25+0x55c/0x990 age=7493 cpu=3 pid=1730
INFO: Slab 0xffffffbde6d5da40 objects=16 used=15 fp=0xffffffc935769700 flags=0x4000000000000080
INFO: Object 0xffffffc935769500 @offset=1280 fp=0x (null)
Bytes b4 ffffffc9357694f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffffffc935769570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Padding ffffffc9357695f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CPU: 3 PID: 1740 Comm: kvm-vcpu-0 Tainted: G B 4.4.0+ #17
Hardware name: ARM Juno development board (r1) (DT)
Call trace:
[<ffffffc00008e770>] dump_backtrace+0x0/0x280
[<ffffffc00008ea04>] show_stack+0x14/0x20
[<ffffffc000726360>] dump_stack+0x100/0x188
[<ffffffc00030d324>] print_trailer+0xfc/0x168
[<ffffffc000312294>] object_err+0x3c/0x50
[<ffffffc0003140fc>] kasan_report_error+0x244/0x558
[<ffffffc000314548>] __asan_report_load8_noabort+0x48/0x50
[<ffffffc000745688>] __bitmap_or+0xc0/0xc8
[<ffffffc0000d9e44>] kvm_vgic_flush_hwstate+0x1bc/0x650
[<ffffffc0000c514c>] kvm_arch_vcpu_ioctl_run+0x2ec/0xa60
[<ffffffc0000b9a6c>] kvm_vcpu_ioctl+0x474/0xa68
[<ffffffc00036b7b0>] do_vfs_ioctl+0x5b8/0xcb0
[<ffffffc00036bf34>] SyS_ioctl+0x8c/0xa0
[<ffffffc000086cb0>] el0_svc_naked+0x24/0x28
Memory state around the buggy address:
ffffffc935769400: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffffc935769480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffffffc935769500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffffffc935769580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffffffc935769600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Fix the issue by always allocating a multiple of sizeof(unsigned long),
as we do elsewhere in the vgic code.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Christoffer Dall <christoffer.dall@linaro.org>
---
virt/kvm/arm/vgic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 7a2f449..5d10f10 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1875,8 +1875,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
{
struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
-
- int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
+ int nr_longs = BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS);
+ int sz = nr_longs * sizeof(unsigned long);
vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
vgic_cpu->active_shared = kzalloc(sz, GFP_KERNEL);
vgic_cpu->pend_act_shared = kzalloc(sz, GFP_KERNEL);
--
1.9.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: arm/arm64: vgic: ensure bitmaps are long enough
2016-02-16 14:47 ` Mark Rutland
@ 2016-02-16 15:11 ` Marc Zyngier
-1 siblings, 0 replies; 6+ messages in thread
From: Marc Zyngier @ 2016-02-16 15:11 UTC (permalink / raw)
To: Mark Rutland, kvmarm; +Cc: kvm, linux-arm-kernel, Christoffer Dall
On 16/02/16 14:47, Mark Rutland wrote:
> When we allocate bitmaps in vgic_vcpu_init_maps, we divide the number of
> bits we need by 8 to figure out how many bytes to allocate. However,
> bitmap elements are always accessed as unsigned longs, and if we didn't
> happen to allocate a size such that size % sizeof(unsigned long) == 0,
> bitmap accesses may go past the end of the allocation.
>
> When using KASAN (which does byte-granular access checks), this results
> in a continuous stream of BUGs whenever these bitmaps are accessed:
>
> =============================================================================
> BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> INFO: Allocated in vgic_init.part.25+0x55c/0x990 age=7493 cpu=3 pid=1730
> INFO: Slab 0xffffffbde6d5da40 objects=16 used=15 fp=0xffffffc935769700 flags=0x4000000000000080
> INFO: Object 0xffffffc935769500 @offset=1280 fp=0x (null)
>
> Bytes b4 ffffffc9357694f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> CPU: 3 PID: 1740 Comm: kvm-vcpu-0 Tainted: G B 4.4.0+ #17
> Hardware name: ARM Juno development board (r1) (DT)
> Call trace:
> [<ffffffc00008e770>] dump_backtrace+0x0/0x280
> [<ffffffc00008ea04>] show_stack+0x14/0x20
> [<ffffffc000726360>] dump_stack+0x100/0x188
> [<ffffffc00030d324>] print_trailer+0xfc/0x168
> [<ffffffc000312294>] object_err+0x3c/0x50
> [<ffffffc0003140fc>] kasan_report_error+0x244/0x558
> [<ffffffc000314548>] __asan_report_load8_noabort+0x48/0x50
> [<ffffffc000745688>] __bitmap_or+0xc0/0xc8
> [<ffffffc0000d9e44>] kvm_vgic_flush_hwstate+0x1bc/0x650
> [<ffffffc0000c514c>] kvm_arch_vcpu_ioctl_run+0x2ec/0xa60
> [<ffffffc0000b9a6c>] kvm_vcpu_ioctl+0x474/0xa68
> [<ffffffc00036b7b0>] do_vfs_ioctl+0x5b8/0xcb0
> [<ffffffc00036bf34>] SyS_ioctl+0x8c/0xa0
> [<ffffffc000086cb0>] el0_svc_naked+0x24/0x28
> Memory state around the buggy address:
> ffffffc935769400: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffffffc935769480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ffffffc935769500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ^
> ffffffc935769580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffffffc935769600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================
>
> Fix the issue by always allocating a multiple of sizeof(unsigned long),
> as we do elsewhere in the vgic code.
>
> Signed-off-by: Mark Rutland <mark.rutland@arm.com>
> Cc: Marc Zyngier <marc.zyngier@arm.com>
> Cc: Christoffer Dall <christoffer.dall@linaro.org>
> ---
> virt/kvm/arm/vgic.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
> index 7a2f449..5d10f10 100644
> --- a/virt/kvm/arm/vgic.c
> +++ b/virt/kvm/arm/vgic.c
> @@ -1875,8 +1875,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
> static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
> {
> struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
> -
> - int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
> + int nr_longs = BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS);
> + int sz = nr_longs * sizeof(unsigned long);
> vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
> vgic_cpu->active_shared = kzalloc(sz, GFP_KERNEL);
> vgic_cpu->pend_act_shared = kzalloc(sz, GFP_KERNEL);
>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Worth mentioning:
Fixes: c1bfb577a ("arm/arm64: KVM: vgic: switch to dynamic allocation")
Cc: stable@vger.kernel.org
Thanks,
M.
--
Jazz is not dead. It just smells funny...
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] KVM: arm/arm64: vgic: ensure bitmaps are long enough
@ 2016-02-16 15:11 ` Marc Zyngier
0 siblings, 0 replies; 6+ messages in thread
From: Marc Zyngier @ 2016-02-16 15:11 UTC (permalink / raw)
To: linux-arm-kernel
On 16/02/16 14:47, Mark Rutland wrote:
> When we allocate bitmaps in vgic_vcpu_init_maps, we divide the number of
> bits we need by 8 to figure out how many bytes to allocate. However,
> bitmap elements are always accessed as unsigned longs, and if we didn't
> happen to allocate a size such that size % sizeof(unsigned long) == 0,
> bitmap accesses may go past the end of the allocation.
>
> When using KASAN (which does byte-granular access checks), this results
> in a continuous stream of BUGs whenever these bitmaps are accessed:
>
> =============================================================================
> BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> INFO: Allocated in vgic_init.part.25+0x55c/0x990 age=7493 cpu=3 pid=1730
> INFO: Slab 0xffffffbde6d5da40 objects=16 used=15 fp=0xffffffc935769700 flags=0x4000000000000080
> INFO: Object 0xffffffc935769500 @offset=1280 fp=0x (null)
>
> Bytes b4 ffffffc9357694f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffffffc935769570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Padding ffffffc9357695f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> CPU: 3 PID: 1740 Comm: kvm-vcpu-0 Tainted: G B 4.4.0+ #17
> Hardware name: ARM Juno development board (r1) (DT)
> Call trace:
> [<ffffffc00008e770>] dump_backtrace+0x0/0x280
> [<ffffffc00008ea04>] show_stack+0x14/0x20
> [<ffffffc000726360>] dump_stack+0x100/0x188
> [<ffffffc00030d324>] print_trailer+0xfc/0x168
> [<ffffffc000312294>] object_err+0x3c/0x50
> [<ffffffc0003140fc>] kasan_report_error+0x244/0x558
> [<ffffffc000314548>] __asan_report_load8_noabort+0x48/0x50
> [<ffffffc000745688>] __bitmap_or+0xc0/0xc8
> [<ffffffc0000d9e44>] kvm_vgic_flush_hwstate+0x1bc/0x650
> [<ffffffc0000c514c>] kvm_arch_vcpu_ioctl_run+0x2ec/0xa60
> [<ffffffc0000b9a6c>] kvm_vcpu_ioctl+0x474/0xa68
> [<ffffffc00036b7b0>] do_vfs_ioctl+0x5b8/0xcb0
> [<ffffffc00036bf34>] SyS_ioctl+0x8c/0xa0
> [<ffffffc000086cb0>] el0_svc_naked+0x24/0x28
> Memory state around the buggy address:
> ffffffc935769400: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffffffc935769480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ffffffc935769500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ^
> ffffffc935769580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffffffc935769600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================
>
> Fix the issue by always allocating a multiple of sizeof(unsigned long),
> as we do elsewhere in the vgic code.
>
> Signed-off-by: Mark Rutland <mark.rutland@arm.com>
> Cc: Marc Zyngier <marc.zyngier@arm.com>
> Cc: Christoffer Dall <christoffer.dall@linaro.org>
> ---
> virt/kvm/arm/vgic.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
> index 7a2f449..5d10f10 100644
> --- a/virt/kvm/arm/vgic.c
> +++ b/virt/kvm/arm/vgic.c
> @@ -1875,8 +1875,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
> static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
> {
> struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
> -
> - int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
> + int nr_longs = BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS);
> + int sz = nr_longs * sizeof(unsigned long);
> vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
> vgic_cpu->active_shared = kzalloc(sz, GFP_KERNEL);
> vgic_cpu->pend_act_shared = kzalloc(sz, GFP_KERNEL);
>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Worth mentioning:
Fixes: c1bfb577a ("arm/arm64: KVM: vgic: switch to dynamic allocation")
Cc: stable at vger.kernel.org
Thanks,
M.
--
Jazz is not dead. It just smells funny...
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] KVM: arm/arm64: vgic: ensure bitmaps are long enough
2016-02-16 15:11 ` Marc Zyngier
@ 2016-02-17 9:15 ` Christoffer Dall
-1 siblings, 0 replies; 6+ messages in thread
From: Christoffer Dall @ 2016-02-17 9:15 UTC (permalink / raw)
To: Marc Zyngier; +Cc: kvmarm, kvm, linux-arm-kernel
On Tue, Feb 16, 2016 at 03:11:22PM +0000, Marc Zyngier wrote:
> On 16/02/16 14:47, Mark Rutland wrote:
> > When we allocate bitmaps in vgic_vcpu_init_maps, we divide the number of
> > bits we need by 8 to figure out how many bytes to allocate. However,
> > bitmap elements are always accessed as unsigned longs, and if we didn't
> > happen to allocate a size such that size % sizeof(unsigned long) == 0,
> > bitmap accesses may go past the end of the allocation.
> >
> > When using KASAN (which does byte-granular access checks), this results
> > in a continuous stream of BUGs whenever these bitmaps are accessed:
> >
> > =============================================================================
> > BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected
> > -----------------------------------------------------------------------------
> >
> > INFO: Allocated in vgic_init.part.25+0x55c/0x990 age=7493 cpu=3 pid=1730
> > INFO: Slab 0xffffffbde6d5da40 objects=16 used=15 fp=0xffffffc935769700 flags=0x4000000000000080
> > INFO: Object 0xffffffc935769500 @offset=1280 fp=0x (null)
> >
> > Bytes b4 ffffffc9357694f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > CPU: 3 PID: 1740 Comm: kvm-vcpu-0 Tainted: G B 4.4.0+ #17
> > Hardware name: ARM Juno development board (r1) (DT)
> > Call trace:
> > [<ffffffc00008e770>] dump_backtrace+0x0/0x280
> > [<ffffffc00008ea04>] show_stack+0x14/0x20
> > [<ffffffc000726360>] dump_stack+0x100/0x188
> > [<ffffffc00030d324>] print_trailer+0xfc/0x168
> > [<ffffffc000312294>] object_err+0x3c/0x50
> > [<ffffffc0003140fc>] kasan_report_error+0x244/0x558
> > [<ffffffc000314548>] __asan_report_load8_noabort+0x48/0x50
> > [<ffffffc000745688>] __bitmap_or+0xc0/0xc8
> > [<ffffffc0000d9e44>] kvm_vgic_flush_hwstate+0x1bc/0x650
> > [<ffffffc0000c514c>] kvm_arch_vcpu_ioctl_run+0x2ec/0xa60
> > [<ffffffc0000b9a6c>] kvm_vcpu_ioctl+0x474/0xa68
> > [<ffffffc00036b7b0>] do_vfs_ioctl+0x5b8/0xcb0
> > [<ffffffc00036bf34>] SyS_ioctl+0x8c/0xa0
> > [<ffffffc000086cb0>] el0_svc_naked+0x24/0x28
> > Memory state around the buggy address:
> > ffffffc935769400: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > ffffffc935769480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >> ffffffc935769500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > ^
> > ffffffc935769580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > ffffffc935769600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
> > ==================================================================
> >
> > Fix the issue by always allocating a multiple of sizeof(unsigned long),
> > as we do elsewhere in the vgic code.
> >
> > Signed-off-by: Mark Rutland <mark.rutland@arm.com>
> > Cc: Marc Zyngier <marc.zyngier@arm.com>
> > Cc: Christoffer Dall <christoffer.dall@linaro.org>
> > ---
> > virt/kvm/arm/vgic.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
> > index 7a2f449..5d10f10 100644
> > --- a/virt/kvm/arm/vgic.c
> > +++ b/virt/kvm/arm/vgic.c
> > @@ -1875,8 +1875,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
> > static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
> > {
> > struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
> > -
> > - int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
> > + int nr_longs = BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS);
> > + int sz = nr_longs * sizeof(unsigned long);
> > vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
> > vgic_cpu->active_shared = kzalloc(sz, GFP_KERNEL);
> > vgic_cpu->pend_act_shared = kzalloc(sz, GFP_KERNEL);
> >
>
> Acked-by: Marc Zyngier <marc.zyngier@arm.com>
>
> Worth mentioning:
>
> Fixes: c1bfb577a ("arm/arm64: KVM: vgic: switch to dynamic allocation")
> Cc: stable@vger.kernel.org
>
Thanks for this fix:
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] KVM: arm/arm64: vgic: ensure bitmaps are long enough
@ 2016-02-17 9:15 ` Christoffer Dall
0 siblings, 0 replies; 6+ messages in thread
From: Christoffer Dall @ 2016-02-17 9:15 UTC (permalink / raw)
To: linux-arm-kernel
On Tue, Feb 16, 2016 at 03:11:22PM +0000, Marc Zyngier wrote:
> On 16/02/16 14:47, Mark Rutland wrote:
> > When we allocate bitmaps in vgic_vcpu_init_maps, we divide the number of
> > bits we need by 8 to figure out how many bytes to allocate. However,
> > bitmap elements are always accessed as unsigned longs, and if we didn't
> > happen to allocate a size such that size % sizeof(unsigned long) == 0,
> > bitmap accesses may go past the end of the allocation.
> >
> > When using KASAN (which does byte-granular access checks), this results
> > in a continuous stream of BUGs whenever these bitmaps are accessed:
> >
> > =============================================================================
> > BUG kmalloc-128 (Tainted: G B ): kasan: bad access detected
> > -----------------------------------------------------------------------------
> >
> > INFO: Allocated in vgic_init.part.25+0x55c/0x990 age=7493 cpu=3 pid=1730
> > INFO: Slab 0xffffffbde6d5da40 objects=16 used=15 fp=0xffffffc935769700 flags=0x4000000000000080
> > INFO: Object 0xffffffc935769500 @offset=1280 fp=0x (null)
> >
> > Bytes b4 ffffffc9357694f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Object ffffffc935769570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > Padding ffffffc9357695f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > CPU: 3 PID: 1740 Comm: kvm-vcpu-0 Tainted: G B 4.4.0+ #17
> > Hardware name: ARM Juno development board (r1) (DT)
> > Call trace:
> > [<ffffffc00008e770>] dump_backtrace+0x0/0x280
> > [<ffffffc00008ea04>] show_stack+0x14/0x20
> > [<ffffffc000726360>] dump_stack+0x100/0x188
> > [<ffffffc00030d324>] print_trailer+0xfc/0x168
> > [<ffffffc000312294>] object_err+0x3c/0x50
> > [<ffffffc0003140fc>] kasan_report_error+0x244/0x558
> > [<ffffffc000314548>] __asan_report_load8_noabort+0x48/0x50
> > [<ffffffc000745688>] __bitmap_or+0xc0/0xc8
> > [<ffffffc0000d9e44>] kvm_vgic_flush_hwstate+0x1bc/0x650
> > [<ffffffc0000c514c>] kvm_arch_vcpu_ioctl_run+0x2ec/0xa60
> > [<ffffffc0000b9a6c>] kvm_vcpu_ioctl+0x474/0xa68
> > [<ffffffc00036b7b0>] do_vfs_ioctl+0x5b8/0xcb0
> > [<ffffffc00036bf34>] SyS_ioctl+0x8c/0xa0
> > [<ffffffc000086cb0>] el0_svc_naked+0x24/0x28
> > Memory state around the buggy address:
> > ffffffc935769400: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > ffffffc935769480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >> ffffffc935769500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > ^
> > ffffffc935769580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > ffffffc935769600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
> > ==================================================================
> >
> > Fix the issue by always allocating a multiple of sizeof(unsigned long),
> > as we do elsewhere in the vgic code.
> >
> > Signed-off-by: Mark Rutland <mark.rutland@arm.com>
> > Cc: Marc Zyngier <marc.zyngier@arm.com>
> > Cc: Christoffer Dall <christoffer.dall@linaro.org>
> > ---
> > virt/kvm/arm/vgic.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
> > index 7a2f449..5d10f10 100644
> > --- a/virt/kvm/arm/vgic.c
> > +++ b/virt/kvm/arm/vgic.c
> > @@ -1875,8 +1875,8 @@ void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
> > static int vgic_vcpu_init_maps(struct kvm_vcpu *vcpu, int nr_irqs)
> > {
> > struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
> > -
> > - int sz = (nr_irqs - VGIC_NR_PRIVATE_IRQS) / 8;
> > + int nr_longs = BITS_TO_LONGS(nr_irqs - VGIC_NR_PRIVATE_IRQS);
> > + int sz = nr_longs * sizeof(unsigned long);
> > vgic_cpu->pending_shared = kzalloc(sz, GFP_KERNEL);
> > vgic_cpu->active_shared = kzalloc(sz, GFP_KERNEL);
> > vgic_cpu->pend_act_shared = kzalloc(sz, GFP_KERNEL);
> >
>
> Acked-by: Marc Zyngier <marc.zyngier@arm.com>
>
> Worth mentioning:
>
> Fixes: c1bfb577a ("arm/arm64: KVM: vgic: switch to dynamic allocation")
> Cc: stable at vger.kernel.org
>
Thanks for this fix:
Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-02-17 9:15 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-16 14:47 [PATCH] KVM: arm/arm64: vgic: ensure bitmaps are long enough Mark Rutland
2016-02-16 14:47 ` Mark Rutland
2016-02-16 15:11 ` Marc Zyngier
2016-02-16 15:11 ` Marc Zyngier
2016-02-17 9:15 ` Christoffer Dall
2016-02-17 9:15 ` Christoffer Dall
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.