kvm: NULL deref in vcpu_enter_guest

[Dmitry Vyukov]

Hello,

The following program triggers NULL deref in vcpu_enter_guest:

BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0
IP: atomic_cmpxchg arch/x86/include/asm/atomic.h:186 [inline]
IP: queued_spin_lock include/asm-generic/qspinlock.h:100 [inline]
IP: do_raw_spin_lock include/linux/spinlock.h:148 [inline]
IP: __raw_spin_lock include/linux/spinlock_api_smp.h:145 [inline]
IP: _raw_spin_lock+0x7/0x20 kernel/locking/spinlock.c:151
PGD 7db45067
PUD 7db44067
PMD 0
Oops: 0002 [#1] SMP
Modules linked in:
CPU: 3 PID: 2747 Comm: a.out Not tainted 4.10.0-rc1+ #55
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88003df0b640 task.stack: ffffc900024e0000
RIP: 0010:atomic_cmpxchg arch/x86/include/asm/atomic.h:186 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:100 [inline]
RIP: 0010:do_raw_spin_lock include/linux/spinlock.h:148 [inline]
RIP: 0010:__raw_spin_lock include/linux/spinlock_api_smp.h:145 [inline]
RIP: 0010:_raw_spin_lock+0x7/0x20 kernel/locking/spinlock.c:151
RSP: 0018:ffffc900024e3d18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88007cc88040 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff88007cc88370 RDI: 00000000000001b0
RBP: ffffc900024e3d48 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88007cc88040 R14: ffff88007cc88370 R15: 0000000000000000
FS: 00000000014a4880(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000001b0 CR3: 000000007ccca000 CR4: 00000000000026e0
Call Trace:
vcpu_scan_ioapic arch/x86/kvm/x86.c:6559 [inline]
vcpu_enter_guest arch/x86/kvm/x86.c:6680 [inline]
vcpu_run arch/x86/kvm/x86.c:6933 [inline]
kvm_arch_vcpu_ioctl_run+0x10be/0x14d0 arch/x86/kvm/x86.c:7091
kvm_vcpu_ioctl+0x30a/0x5c0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2567
vfs_ioctl fs/ioctl.c:43 [inline]
do_vfs_ioctl+0x8f/0x5a0 fs/ioctl.c:683
SYSC_ioctl fs/ioctl.c:698 [inline]
SyS_ioctl+0x74/0x80 fs/ioctl.c:689
entry_SYSCALL_64_fastpath+0x1a/0xa9
RIP: 0033:0x43f437
RSP: 002b:00007ffcb80085f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043f437
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00007ffcb8008810 R08: 00000000006d0c68 R09: 00000000006d0ce0
R10: 00007f4830dc39d0 R11: 0000000000000202 R12: 0000000000000000
R13: 000000000040bfe0 R14: 000000000040c070 R15: 0000000000000000
Code: 00 00 00 00 55 48 89 e5 8b 07 85 c0 74 04 31 c0 5d c3 ba 01 00
00 00 f0 0f b1 17 85 c0 75 ef b0 01 5d c3 90 31 c0 ba 01 00 00 00 <f0>
0f b1 17 85 c0 75 01 c3 55 89 c6 48 89 e5 e8 75 20 76 ff 5d
RIP: atomic_cmpxchg arch/x86/include/asm/atomic.h:186 [inline] RSP:
ffffc900024e3d18
RIP: queued_spin_lock include/asm-generic/qspinlock.h:100 [inline]
RSP: ffffc900024e3d18
RIP: do_raw_spin_lock include/linux/spinlock.h:148 [inline] RSP:
ffffc900024e3d18
RIP: __raw_spin_lock include/linux/spinlock_api_smp.h:145 [inline]
RSP: ffffc900024e3d18
RIP: _raw_spin_lock+0x7/0x20 kernel/locking/spinlock.c:151 RSP: ffffc900024e3d18
CR2: 00000000000001b0
---[ end trace 820952a240d809e9 ]---


// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <linux/kvm.h>
#include <pthread.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#ifndef KVM_CAP_HYPERV_SYNIC
#define KVM_CAP_HYPERV_SYNIC 123
#endif

void* thr(void* arg)
{
struct kvm_enable_cap cap;
cap.flags = 0;
cap.cap = KVM_CAP_HYPERV_SYNIC;
ioctl((long)arg, KVM_ENABLE_CAP, &cap);
return 0;
}

int main()
{
void *host_mem = mmap(0, 0x1000, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
int kvmfd = open("/dev/kvm", 0);
int vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
struct kvm_userspace_memory_region memreg;
memreg.slot = 0;
memreg.flags = 0;
memreg.guest_phys_addr = 0;
memreg.memory_size = 0x1000;
memreg.userspace_addr = (unsigned long)host_mem;
memcpy(host_mem,
"\x1a\xb5\x00\x04\x65\x26\x64\x26\xf0\x82\xaa\x00"
"\x02\x00\x3e\x75\x64\xf3\xf3\xf0\x18\x35\x66\xb9"
"\x99\x00\x00\x40\x46\xb8\xc0\x40\x00\x00\x66\xba"
"\x00\x00\x00\x00\x0f\x30\x0f\xfc\xda\xdb\xca\x36"
"\x26\x3e\x67\x3e\x67\xcf\x66\xb9\x4a\x0a\x00\x00"
"\x0f\x32\x2e\x26\x65\x0f\x0f\x01\xa0",
69);
ioctl(vmfd, KVM_SET_USER_MEMORY_REGION, &memreg);
int cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
struct kvm_sregs sregs;
ioctl(cpufd, KVM_GET_SREGS, &sregs);
sregs.cr0 = 0;
sregs.cr4 = 0;
sregs.efer = 0;
sregs.cs.selector = 0;
sregs.cs.base = 0;
ioctl(cpufd, KVM_SET_SREGS, &sregs);
struct kvm_regs regs;
memset(&regs, 0, sizeof(regs));
regs.rflags = 2;
ioctl(cpufd, KVM_SET_REGS, &regs);
ioctl(vmfd, KVM_CREATE_IRQCHIP, 0);
pthread_t th;
pthread_create(&th, 0, thr, (void*)(long)cpufd);
usleep(rand() % 10000);
ioctl(cpufd, KVM_RUN, 0);
pthread_join(th, 0);
return 0;
}


On commit 0dad3a3014a0b9e72521ff44f17e0054f43dcdea (Dec 26)