mirror of
				git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
				synced 2025-10-31 08:44:41 +00:00 
			
		
		
		
	 23fa2e46a5
			
		
	
	
		23fa2e46a5
		
	
	
	
	
		
			
			BUG: KASAN: use-after-free in kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183
Read of size 8 at addr ffff0000c03a2500 by task syz-executor083/4269
CPU: 5 PID: 4269 Comm: syz-executor083 Not tainted 5.10.0 #7
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132
 show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x110/0x164 lib/dump_stack.c:118
 print_address_description+0x78/0x5c8 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report+0x148/0x1e4 mm/kasan/report.c:562
 check_memory_region_inline mm/kasan/generic.c:183 [inline]
 __asan_load8+0xb4/0xbc mm/kasan/generic.c:252
 kvm_vm_ioctl_unregister_coalesced_mmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:183
 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]
 do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220
 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367
 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383
 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670
Allocated by task 4269:
 stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461
 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475
 kmem_cache_alloc_trace include/linux/slab.h:450 [inline]
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc include/linux/slab.h:664 [inline]
 kvm_vm_ioctl_register_coalesced_mmio+0x78/0x1cc arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:146
 kvm_vm_ioctl+0x7e8/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3746
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]
 do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220
 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367
 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383
 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670
Freed by task 4269:
 stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track+0x38/0x6c mm/kasan/common.c:56
 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355
 __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422
 kasan_slab_free+0x10/0x1c mm/kasan/common.c:431
 slab_free_hook mm/slub.c:1544 [inline]
 slab_free_freelist_hook mm/slub.c:1577 [inline]
 slab_free mm/slub.c:3142 [inline]
 kfree+0x104/0x38c mm/slub.c:4124
 coalesced_mmio_destructor+0x94/0xa4 arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:102
 kvm_iodevice_destructor include/kvm/iodev.h:61 [inline]
 kvm_io_bus_unregister_dev+0x248/0x280 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:4374
 kvm_vm_ioctl_unregister_coalesced_mmio+0x158/0x1ec arch/arm64/kvm/../../../virt/kvm/coalesced_mmio.c:186
 kvm_vm_ioctl+0xe30/0x14c4 arch/arm64/kvm/../../../virt/kvm/kvm_main.c:3755
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __arm64_sys_ioctl+0xf88/0x131c fs/ioctl.c:739
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]
 do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:220
 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367
 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383
 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670
If kvm_io_bus_unregister_dev() return -ENOMEM, we already call kvm_iodevice_destructor()
inside this function to delete 'struct kvm_coalesced_mmio_dev *dev' from list
and free the dev, but kvm_iodevice_destructor() is called again, it will lead
the above issue.
Let's check the the return value of kvm_io_bus_unregister_dev(), only call
kvm_iodevice_destructor() if the return value is 0.
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Message-Id: <20210626070304.143456-1-wangkefeng.wang@huawei.com>
Cc: stable@vger.kernel.org
Fixes: 5d3c4c7938 ("KVM: Stop looking for coalesced MMIO zones if the bus is destroyed", 2021-04-20)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
		
	
			
		
			
				
	
	
		
			209 lines
		
	
	
	
		
			4.9 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			209 lines
		
	
	
	
		
			4.9 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| // SPDX-License-Identifier: GPL-2.0
 | |
| /*
 | |
|  * KVM coalesced MMIO
 | |
|  *
 | |
|  * Copyright (c) 2008 Bull S.A.S.
 | |
|  * Copyright 2009 Red Hat, Inc. and/or its affiliates.
 | |
|  *
 | |
|  *  Author: Laurent Vivier <Laurent.Vivier@bull.net>
 | |
|  *
 | |
|  */
 | |
| 
 | |
| #include <kvm/iodev.h>
 | |
| 
 | |
| #include <linux/kvm_host.h>
 | |
| #include <linux/slab.h>
 | |
| #include <linux/kvm.h>
 | |
| 
 | |
| #include "coalesced_mmio.h"
 | |
| 
 | |
| static inline struct kvm_coalesced_mmio_dev *to_mmio(struct kvm_io_device *dev)
 | |
| {
 | |
| 	return container_of(dev, struct kvm_coalesced_mmio_dev, dev);
 | |
| }
 | |
| 
 | |
| static int coalesced_mmio_in_range(struct kvm_coalesced_mmio_dev *dev,
 | |
| 				   gpa_t addr, int len)
 | |
| {
 | |
| 	/* is it in a batchable area ?
 | |
| 	 * (addr,len) is fully included in
 | |
| 	 * (zone->addr, zone->size)
 | |
| 	 */
 | |
| 	if (len < 0)
 | |
| 		return 0;
 | |
| 	if (addr + len < addr)
 | |
| 		return 0;
 | |
| 	if (addr < dev->zone.addr)
 | |
| 		return 0;
 | |
| 	if (addr + len > dev->zone.addr + dev->zone.size)
 | |
| 		return 0;
 | |
| 	return 1;
 | |
| }
 | |
| 
 | |
| static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev, u32 last)
 | |
| {
 | |
| 	struct kvm_coalesced_mmio_ring *ring;
 | |
| 	unsigned avail;
 | |
| 
 | |
| 	/* Are we able to batch it ? */
 | |
| 
 | |
| 	/* last is the first free entry
 | |
| 	 * check if we don't meet the first used entry
 | |
| 	 * there is always one unused entry in the buffer
 | |
| 	 */
 | |
| 	ring = dev->kvm->coalesced_mmio_ring;
 | |
| 	avail = (ring->first - last - 1) % KVM_COALESCED_MMIO_MAX;
 | |
| 	if (avail == 0) {
 | |
| 		/* full */
 | |
| 		return 0;
 | |
| 	}
 | |
| 
 | |
| 	return 1;
 | |
| }
 | |
| 
 | |
| static int coalesced_mmio_write(struct kvm_vcpu *vcpu,
 | |
| 				struct kvm_io_device *this, gpa_t addr,
 | |
| 				int len, const void *val)
 | |
| {
 | |
| 	struct kvm_coalesced_mmio_dev *dev = to_mmio(this);
 | |
| 	struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;
 | |
| 	__u32 insert;
 | |
| 
 | |
| 	if (!coalesced_mmio_in_range(dev, addr, len))
 | |
| 		return -EOPNOTSUPP;
 | |
| 
 | |
| 	spin_lock(&dev->kvm->ring_lock);
 | |
| 
 | |
| 	insert = READ_ONCE(ring->last);
 | |
| 	if (!coalesced_mmio_has_room(dev, insert) ||
 | |
| 	    insert >= KVM_COALESCED_MMIO_MAX) {
 | |
| 		spin_unlock(&dev->kvm->ring_lock);
 | |
| 		return -EOPNOTSUPP;
 | |
| 	}
 | |
| 
 | |
| 	/* copy data in first free entry of the ring */
 | |
| 
 | |
| 	ring->coalesced_mmio[insert].phys_addr = addr;
 | |
| 	ring->coalesced_mmio[insert].len = len;
 | |
| 	memcpy(ring->coalesced_mmio[insert].data, val, len);
 | |
| 	ring->coalesced_mmio[insert].pio = dev->zone.pio;
 | |
| 	smp_wmb();
 | |
| 	ring->last = (insert + 1) % KVM_COALESCED_MMIO_MAX;
 | |
| 	spin_unlock(&dev->kvm->ring_lock);
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| static void coalesced_mmio_destructor(struct kvm_io_device *this)
 | |
| {
 | |
| 	struct kvm_coalesced_mmio_dev *dev = to_mmio(this);
 | |
| 
 | |
| 	list_del(&dev->list);
 | |
| 
 | |
| 	kfree(dev);
 | |
| }
 | |
| 
 | |
| static const struct kvm_io_device_ops coalesced_mmio_ops = {
 | |
| 	.write      = coalesced_mmio_write,
 | |
| 	.destructor = coalesced_mmio_destructor,
 | |
| };
 | |
| 
 | |
| int kvm_coalesced_mmio_init(struct kvm *kvm)
 | |
| {
 | |
| 	struct page *page;
 | |
| 
 | |
| 	page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
 | |
| 	if (!page)
 | |
| 		return -ENOMEM;
 | |
| 
 | |
| 	kvm->coalesced_mmio_ring = page_address(page);
 | |
| 
 | |
| 	/*
 | |
| 	 * We're using this spinlock to sync access to the coalesced ring.
 | |
| 	 * The list doesn't need its own lock since device registration and
 | |
| 	 * unregistration should only happen when kvm->slots_lock is held.
 | |
| 	 */
 | |
| 	spin_lock_init(&kvm->ring_lock);
 | |
| 	INIT_LIST_HEAD(&kvm->coalesced_zones);
 | |
| 
 | |
| 	return 0;
 | |
| }
 | |
| 
 | |
| void kvm_coalesced_mmio_free(struct kvm *kvm)
 | |
| {
 | |
| 	if (kvm->coalesced_mmio_ring)
 | |
| 		free_page((unsigned long)kvm->coalesced_mmio_ring);
 | |
| }
 | |
| 
 | |
| int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm,
 | |
| 					 struct kvm_coalesced_mmio_zone *zone)
 | |
| {
 | |
| 	int ret;
 | |
| 	struct kvm_coalesced_mmio_dev *dev;
 | |
| 
 | |
| 	if (zone->pio != 1 && zone->pio != 0)
 | |
| 		return -EINVAL;
 | |
| 
 | |
| 	dev = kzalloc(sizeof(struct kvm_coalesced_mmio_dev),
 | |
| 		      GFP_KERNEL_ACCOUNT);
 | |
| 	if (!dev)
 | |
| 		return -ENOMEM;
 | |
| 
 | |
| 	kvm_iodevice_init(&dev->dev, &coalesced_mmio_ops);
 | |
| 	dev->kvm = kvm;
 | |
| 	dev->zone = *zone;
 | |
| 
 | |
| 	mutex_lock(&kvm->slots_lock);
 | |
| 	ret = kvm_io_bus_register_dev(kvm,
 | |
| 				zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS,
 | |
| 				zone->addr, zone->size, &dev->dev);
 | |
| 	if (ret < 0)
 | |
| 		goto out_free_dev;
 | |
| 	list_add_tail(&dev->list, &kvm->coalesced_zones);
 | |
| 	mutex_unlock(&kvm->slots_lock);
 | |
| 
 | |
| 	return 0;
 | |
| 
 | |
| out_free_dev:
 | |
| 	mutex_unlock(&kvm->slots_lock);
 | |
| 	kfree(dev);
 | |
| 
 | |
| 	return ret;
 | |
| }
 | |
| 
 | |
| int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
 | |
| 					   struct kvm_coalesced_mmio_zone *zone)
 | |
| {
 | |
| 	struct kvm_coalesced_mmio_dev *dev, *tmp;
 | |
| 	int r;
 | |
| 
 | |
| 	if (zone->pio != 1 && zone->pio != 0)
 | |
| 		return -EINVAL;
 | |
| 
 | |
| 	mutex_lock(&kvm->slots_lock);
 | |
| 
 | |
| 	list_for_each_entry_safe(dev, tmp, &kvm->coalesced_zones, list) {
 | |
| 		if (zone->pio == dev->zone.pio &&
 | |
| 		    coalesced_mmio_in_range(dev, zone->addr, zone->size)) {
 | |
| 			r = kvm_io_bus_unregister_dev(kvm,
 | |
| 				zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev);
 | |
| 
 | |
| 			/*
 | |
| 			 * On failure, unregister destroys all devices on the
 | |
| 			 * bus _except_ the target device, i.e. coalesced_zones
 | |
| 			 * has been modified.  No need to restart the walk as
 | |
| 			 * there aren't any zones left.
 | |
| 			 */
 | |
| 			if (r)
 | |
| 				break;
 | |
| 			kvm_iodevice_destructor(&dev->dev);
 | |
| 		}
 | |
| 	}
 | |
| 
 | |
| 	mutex_unlock(&kvm->slots_lock);
 | |
| 
 | |
| 	/*
 | |
| 	 * Ignore the result of kvm_io_bus_unregister_dev(), from userspace's
 | |
| 	 * perspective, the coalesced MMIO is most definitely unregistered.
 | |
| 	 */
 | |
| 	return 0;
 | |
| }
 |