linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Dmitry Vyukov <dvyukov@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: "Robert Święcki" <robert@swiecki.net>,
	LKML <linux-kernel@vger.kernel.org>,
	"Borislav Petkov" <bp@alien8.de>
Subject: Re: NULL-ptr deref in kvm_arch_vcpu_ioctl under AMD CPUs
Date: Tue, 30 Aug 2016 15:08:19 +0200	[thread overview]
Message-ID: <CACT4Y+bs6Q2uvG1PXE-HL0jj3f+q9487S0M_wv0v=B9Ws8SAUw@mail.gmail.com> (raw)
In-Reply-To: <7810f213-c6a5-b4b7-b95d-cd9dc2570641@redhat.com>

On Mon, Aug 29, 2016 at 2:02 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
> On 19/08/2016 02:16, Dmitry Vyukov wrote:
>> > > This seems non-exploitable due to mmap_min_addr, so I guess it should
>> > > be treated just as a regular bug
>> >
>> > Probably fixed by commit 4c5ea0a9cd02 ("locking/static_key: Fix
>> > concurrent static_key_slow_inc()", 2016-06-21).  There should be no
>> > outstanding syzkaller reports for KVM now!
>>
>> Thanks for the update. I will try to reenable kvm fuzzing on my
>> syzkaller instances.
>> Just to make sure, you mean all bugs prefixed with kvm: here, right?
>> https://github.com/google/syzkaller/wiki/Found-Bugs
>
> Yes.  These are the relevant commits:
>
> b21629da120   kvm: x86: avoid warning on repeated KVM_SET_TSS_ADDR
> 83676e92389   KVM: x86: avoid vmalloc(0) in the KVM_SET_CPUID
> 78e546c824f   KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number
> c622a3c21ed   KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi
> f8c1b85b252   KVM: x86: avoid vmalloc(0) in the KVM_SET_CPUID
> d14bdb553f9   KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS
> 250715a6171   KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
> 4c5ea0a9cd0   locking/static_key: Fix concurrent static_key_slow_inc()
>
> The last one is responsible for most if not all of the OOPses with
> threads.


I've started fuzzing kvm again. No crashes so far.

  reply	other threads:[~2016-08-30 13:08 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-02-19 14:06 NULL-ptr deref in kvm_arch_vcpu_ioctl under AMD CPUs Robert Święcki
2016-02-19 16:29 ` Robert Święcki
2016-08-18 11:58 ` Paolo Bonzini
2016-08-19  0:16   ` Dmitry Vyukov
2016-08-29 12:02     ` Paolo Bonzini
2016-08-30 13:08       ` Dmitry Vyukov [this message]
2016-08-30 15:03         ` Paolo Bonzini
2016-09-09 23:03           ` Dmitry Vyukov
2016-09-10  6:43             ` Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CACT4Y+bs6Q2uvG1PXE-HL0jj3f+q9487S0M_wv0v=B9Ws8SAUw@mail.gmail.com' \
    --to=dvyukov@google.com \
    --cc=bp@alien8.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pbonzini@redhat.com \
    --cc=robert@swiecki.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).