From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Andrew Melnychenko <andrew@daynix.com>
Subject: [PATCH 4.9 46/80] tty: hvc: fix buffer overflow during hvc_alloc().
Date: Fri, 1 May 2020 15:21:40 +0200 [thread overview]
Message-ID: <20200501131528.064407675@linuxfoundation.org> (raw)
In-Reply-To: <20200501131513.810761598@linuxfoundation.org>
From: Andrew Melnychenko <andrew@daynix.com>
commit 9a9fc42b86c06120744555fea43fdcabe297c656 upstream.
If there is a lot(more then 16) of virtio-console devices
or virtio_console module is reloaded
- buffers 'vtermnos' and 'cons_ops' are overflowed.
In older kernels it overruns spinlock which leads to kernel freezing:
https://bugzilla.redhat.com/show_bug.cgi?id=1786239
To reproduce the issue, you can try simple script that
loads/unloads module. Something like this:
while [ 1 ]
do
modprobe virtio_console
sleep 2
modprobe -r virtio_console
sleep 2
done
Description of problem:
Guest get 'Call Trace' when loading module "virtio_console"
and unloading it frequently - clearly reproduced on kernel-4.18.0:
[ 81.498208] ------------[ cut here ]------------
[ 81.499263] pvqspinlock: lock 0xffffffff92080020 has corrupted value 0xc0774ca0!
[ 81.501000] WARNING: CPU: 0 PID: 785 at kernel/locking/qspinlock_paravirt.h:500 __pv_queued_spin_unlock_slowpath+0xc0/0xd0
[ 81.503173] Modules linked in: virtio_console fuse xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nft_counter nf_nat_tftp nft_objref nf_conntrack_tftp tun bridge stp llc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 nft_chain_route_ipv6 nft_chain_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack nft_chain_route_ipv4 ip6_tables nft_compat ip_set nf_tables nfnetlink sunrpc bochs_drm drm_vram_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm i2c_piix4 pcspkr crct10dif_pclmul crc32_pclmul joydev ghash_clmulni_intel ip_tables xfs libcrc32c sd_mod sg ata_generic ata_piix virtio_net libata crc32c_intel net_failover failover serio_raw virtio_scsi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: virtio_console]
[ 81.517019] CPU: 0 PID: 785 Comm: kworker/0:2 Kdump: loaded Not tainted 4.18.0-167.el8.x86_64 #1
[ 81.518639] Hardware name: Red Hat KVM, BIOS 1.12.0-5.scrmod+el8.2.0+5159+d8aa4d83 04/01/2014
[ 81.520205] Workqueue: events control_work_handler [virtio_console]
[ 81.521354] RIP: 0010:__pv_queued_spin_unlock_slowpath+0xc0/0xd0
[ 81.522450] Code: 07 00 48 63 7a 10 e8 bf 64 f5 ff 66 90 c3 8b 05 e6 cf d6 01 85 c0 74 01 c3 8b 17 48 89 fe 48 c7 c7 38 4b 29 91 e8 3a 6c fa ff <0f> 0b c3 0f 0b 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48
[ 81.525830] RSP: 0018:ffffb51a01ffbd70 EFLAGS: 00010282
[ 81.526798] RAX: 0000000000000000 RBX: 0000000000000010 RCX: 0000000000000000
[ 81.528110] RDX: ffff9e66f1826480 RSI: ffff9e66f1816a08 RDI: ffff9e66f1816a08
[ 81.529437] RBP: ffffffff9153ff10 R08: 000000000000026c R09: 0000000000000053
[ 81.530732] R10: 0000000000000000 R11: ffffb51a01ffbc18 R12: ffff9e66cd682200
[ 81.532133] R13: ffffffff9153ff10 R14: ffff9e6685569500 R15: ffff9e66cd682000
[ 81.533442] FS: 0000000000000000(0000) GS:ffff9e66f1800000(0000) knlGS:0000000000000000
[ 81.534914] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 81.535971] CR2: 00005624c55b14d0 CR3: 00000003a023c000 CR4: 00000000003406f0
[ 81.537283] Call Trace:
[ 81.537763] __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x20
[ 81.539011] .slowpath+0x9/0xe
[ 81.539585] hvc_alloc+0x25e/0x300
[ 81.540237] init_port_console+0x28/0x100 [virtio_console]
[ 81.541251] handle_control_message.constprop.27+0x1c4/0x310 [virtio_console]
[ 81.542546] control_work_handler+0x70/0x10c [virtio_console]
[ 81.543601] process_one_work+0x1a7/0x3b0
[ 81.544356] worker_thread+0x30/0x390
[ 81.545025] ? create_worker+0x1a0/0x1a0
[ 81.545749] kthread+0x112/0x130
[ 81.546358] ? kthread_flush_work_fn+0x10/0x10
[ 81.547183] ret_from_fork+0x22/0x40
[ 81.547842] ---[ end trace aa97649bd16c8655 ]---
[ 83.546539] general protection fault: 0000 [#1] SMP NOPTI
[ 83.547422] CPU: 5 PID: 3225 Comm: modprobe Kdump: loaded Tainted: G W --------- - - 4.18.0-167.el8.x86_64 #1
[ 83.549191] Hardware name: Red Hat KVM, BIOS 1.12.0-5.scrmod+el8.2.0+5159+d8aa4d83 04/01/2014
[ 83.550544] RIP: 0010:__pv_queued_spin_lock_slowpath+0x19a/0x2a0
[ 83.551504] Code: c4 c1 ea 12 41 be 01 00 00 00 4c 8d 6d 14 41 83 e4 03 8d 42 ff 49 c1 e4 05 48 98 49 81 c4 40 a5 02 00 4c 03 24 c5 60 48 34 91 <49> 89 2c 24 b8 00 80 00 00 eb 15 84 c0 75 0a 41 0f b6 54 24 14 84
[ 83.554449] RSP: 0018:ffffb51a0323fdb0 EFLAGS: 00010202
[ 83.555290] RAX: 000000000000301c RBX: ffffffff92080020 RCX: 0000000000000001
[ 83.556426] RDX: 000000000000301d RSI: 0000000000000000 RDI: 0000000000000000
[ 83.557556] RBP: ffff9e66f196a540 R08: 000000000000028a R09: ffff9e66d2757788
[ 83.558688] R10: 0000000000000000 R11: 0000000000000000 R12: 646e61725f770b07
[ 83.559821] R13: ffff9e66f196a554 R14: 0000000000000001 R15: 0000000000180000
[ 83.560958] FS: 00007fd5032e8740(0000) GS:ffff9e66f1940000(0000) knlGS:0000000000000000
[ 83.562233] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 83.563149] CR2: 00007fd5022b0da0 CR3: 000000038c334000 CR4: 00000000003406e0
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200414191503.3471783-1-andrew@daynix.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/hvc/hvc_console.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -289,10 +289,6 @@ int hvc_instantiate(uint32_t vtermno, in
vtermnos[index] = vtermno;
cons_ops[index] = ops;
- /* reserve all indices up to and including this index */
- if (last_hvc < index)
- last_hvc = index;
-
/* check if we need to re-register the kernel console */
hvc_check_console(index);
@@ -896,13 +892,22 @@ struct hvc_struct *hvc_alloc(uint32_t vt
cons_ops[i] == hp->ops)
break;
- /* no matching slot, just use a counter */
- if (i >= MAX_NR_HVC_CONSOLES)
- i = ++last_hvc;
+ if (i >= MAX_NR_HVC_CONSOLES) {
+
+ /* find 'empty' slot for console */
+ for (i = 0; i < MAX_NR_HVC_CONSOLES && vtermnos[i] != -1; i++) {
+ }
+
+ /* no matching slot, just use a counter */
+ if (i == MAX_NR_HVC_CONSOLES)
+ i = ++last_hvc + MAX_NR_HVC_CONSOLES;
+ }
hp->index = i;
- cons_ops[i] = ops;
- vtermnos[i] = vtermno;
+ if (i < MAX_NR_HVC_CONSOLES) {
+ cons_ops[i] = ops;
+ vtermnos[i] = vtermno;
+ }
list_add_tail(&(hp->next), &hvc_structs);
spin_unlock(&hvc_structs_lock);
next prev parent reply other threads:[~2020-05-01 13:59 UTC|newest]
Thread overview: 85+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-01 13:20 [PATCH 4.9 00/80] 4.9.221-rc1 review Greg Kroah-Hartman
2020-05-01 13:20 ` [PATCH 4.9 01/80] ext4: fix extent_status fragmentation for plain files Greg Kroah-Hartman
2020-05-01 13:20 ` [PATCH 4.9 02/80] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() Greg Kroah-Hartman
2020-05-01 13:20 ` [PATCH 4.9 03/80] net: ipv4: avoid unused variable warning for sysctl Greg Kroah-Hartman
2020-05-01 13:20 ` [PATCH 4.9 04/80] drm/msm: Use the correct dma_sync calls harder Greg Kroah-Hartman
2020-05-01 13:20 ` [PATCH 4.9 05/80] crypto: mxs-dcp - make symbols sha1_null_hash and sha256_null_hash static Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 06/80] vti4: removed duplicate log message Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 07/80] watchdog: reset last_hw_keepalive time at start Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 08/80] scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 09/80] ceph: return ceph_mdsc_do_request() errors from __get_parent() Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 10/80] ceph: dont skip updating wanted caps when cap is stale Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 11/80] pwm: rcar: Fix late Runtime PM enablement Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 12/80] scsi: iscsi: Report unbind session event when the target has been removed Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 13/80] ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 14/80] kernel/gcov/fs.c: gcov_seq_next() should increase position index Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 15/80] ipc/util.c: sysvipc_find_ipc() " Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 16/80] s390/cio: avoid duplicated ADD uevents Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 17/80] pwm: renesas-tpu: Fix late Runtime PM enablement Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 18/80] pwm: bcm2835: Dynamically allocate base Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 19/80] PCI/ASPM: Allow re-enabling Clock PM Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 20/80] ipv6: fix restrict IPV6_ADDRFORM operation Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 21/80] macsec: avoid to set wrong mtu Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 22/80] macvlan: fix null dereference in macvlan_device_event() Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 23/80] net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 24/80] net/x25: Fix x25_neigh refcnt leak when receiving frame Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 25/80] tcp: cache line align MAX_TCP_HEADER Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 26/80] team: fix hang in team_mode_get() Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 27/80] net: dsa: b53: Fix ARL register definitions Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 28/80] xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 29/80] ALSA: hda: Remove ASUS ROG Zenith from the blacklist Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 30/80] iio: xilinx-xadc: Fix ADC-B powerdown Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 31/80] iio: xilinx-xadc: Fix clearing interrupt when enabling trigger Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 32/80] iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 33/80] fs/namespace.c: fix mountpoint reference counter race Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 34/80] USB: sisusbvga: Change port variable from signed to unsigned Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 35/80] USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 36/80] USB: core: Fix free-while-in-use bug in the USB S-Glibrary Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 37/80] USB: hub: Fix handling of connect changes during sleep Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 38/80] overflow.h: Add arithmetic shift helper Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 39/80] vmalloc: fix remap_vmalloc_range() bounds checks Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 40/80] ALSA: usx2y: Fix potential NULL dereference Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 41/80] ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 42/80] ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 43/80] tpm/tpm_tis: Free IRQ if probing fails Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 44/80] KVM: Check validity of resolved slot when searching memslots Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 45/80] KVM: VMX: Enable machine check support for 32bit targets Greg Kroah-Hartman
2020-05-01 13:21 ` Greg Kroah-Hartman [this message]
2020-05-01 13:21 ` [PATCH 4.9 47/80] tty: rocket, avoid OOB access Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 48/80] usb-storage: Add unusual_devs entry for JMicron JMS566 Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 49/80] audit: check the length of userspace generated audit records Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 50/80] ASoC: dapm: fixup dapm kcontrol widget Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 51/80] ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 52/80] staging: comedi: dt2815: fix writing hi byte of analog output Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 53/80] staging: comedi: Fix comedi_device refcnt leak in comedi_open Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 54/80] staging: vt6656: Fix drivers TBTT timing counter Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 55/80] staging: vt6656: Power save stop wake_up_count wrap around Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 56/80] UAS: no use logging any details in case of ENODEV Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 57/80] UAS: fix deadlock in error handling and PM flushing work Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 58/80] usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 59/80] remoteproc: Fix wrong rvring index computation Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 60/80] fuse: fix possibly missed wake-up after abort Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 61/80] mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 62/80] usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 63/80] nfsd: memory corruption in nfsd4_lock() Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 64/80] net/cxgb4: Check the return from t4_query_params properly Greg Kroah-Hartman
2020-05-01 13:21 ` [PATCH 4.9 65/80] perf/core: fix parent pid/tid in task exit events Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 66/80] bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 67/80] xfs: fix partially uninitialized structure in xfs_reflink_remap_extent Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 68/80] scsi: target: fix PR IN / READ FULL STATUS for FC Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 69/80] objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 70/80] objtool: Support Clang non-section symbols in ORC dump Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 71/80] xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 72/80] ext4: convert BUG_ONs to WARN_ONs in mballoc.c Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 73/80] of: unittest: kmemleak on changeset destroy Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 74/80] hwmon: (jc42) Fix name to have no illegal characters Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 75/80] ext4: avoid declaring fs inconsistent due to invalid file handles Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 76/80] ext4: protect journal inodes blocks using block_validity Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 77/80] ext4: dont perform block validity checks on the journal inode Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 78/80] ext4: fix block validity checks for journal inodes using indirect blocks Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 79/80] ext4: unsigned int compared against zero Greg Kroah-Hartman
2020-05-01 13:22 ` [PATCH 4.9 80/80] ext4: check for non-zero journal inum in ext4_calculate_overhead Greg Kroah-Hartman
2020-05-01 15:16 ` [PATCH 4.9 00/80] 4.9.221-rc1 review Jon Hunter
2020-05-01 21:58 ` Guenter Roeck
2020-05-01 22:43 ` Naresh Kamboju
2020-05-02 23:18 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200501131528.064407675@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andrew@daynix.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).