kvm: GPF in irqfd_shutdown/eventfd_ctx_remove_wait_queue

16 views
Skip to first unread message

Dmitry Vyukov

unread,
Nov 12, 2016, 4:28:12 PM11/12/16
to Paolo Bonzini, rkr...@redhat.com, Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x...@kernel.org, KVM list, LKML, Steve Rutherford, syzkaller
Hello,

I've got the following crash while running syzkaller fuzzer.
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
Unfortunately it is not reproducible.
May be related to:
https://groups.google.com/forum/#!topic/syzkaller/NKlClJzOOww
https://groups.google.com/forum/#!topic/syzkaller/Dz__GySpVr8

general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 17194 Comm: kworker/0:2 Not tainted 4.9.0-rc4+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: kvm-irqfd-cleanup irqfd_shutdown
task: ffff88003b2bdb40 task.stack: ffff88003bcd8000
RIP: 0010:[<ffffffff8175b8e9>] [< inline >] __list_del
include/linux/list.h:89
RIP: 0010:[<ffffffff8175b8e9>] [< inline >] list_del
include/linux/list.h:107
RIP: 0010:[<ffffffff8175b8e9>] [< inline >]
__remove_wait_queue include/linux/wait.h:196
RIP: 0010:[<ffffffff8175b8e9>] [<ffffffff8175b8e9>]
eventfd_ctx_remove_wait_queue+0x139/0x2d0 fs/eventfd.c:201
RSP: 0018:ffff88003bcdfb50 EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88003cefbd40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008
RBP: ffff88003bcdfb90 R08: 0000000090a58b45 R09: 0000000000000001
R10: ffffffff84da2600 R11: 1ffff1000779bf36 R12: ffff88003b986b88
R13: ffff88003bcdfbc8 R14: ffff88003cefbd48 R15: 0000000000000081
FS: 0000000000000000(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000813000 CR3: 0000000065fd4000 CR4: 00000000000026f0
Stack:
ffff88003bcdfb60 ffff88003cefbd90 0000000000000296 ffff88003b986b80
ffff88003b986ca8 1ffff1000779bf75 ffff88003b986c80 dffffc0000000000
ffff88003bcdfc30 ffffffff8106dd86 0000000000000000 0000000041b58ab3
Call Trace:
[<ffffffff8106dd86>] irqfd_shutdown+0x96/0x1a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:128
[<ffffffff8129175c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096
[<ffffffff8129274f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230
[<ffffffff812a5a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
[<ffffffff831f102a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
Code: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 83 01 00 00 48 8d 7a 08
48 b9 00 00 00 00 00 fc ff df 49 8b 44 24 20 48 89 fe 48 c1 ee 03 <80>
3c 0e 00 0f 85 45 01 00 00 48 89 c6 48 b9 00 00 00 00 00 fc
RIP [< inline >] __list_del include/linux/list.h:89
RIP [< inline >] list_del include/linux/list.h:107
RIP [< inline >] __remove_wait_queue include/linux/wait.h:196
RIP [<ffffffff8175b8e9>] eventfd_ctx_remove_wait_queue+0x139/0x2d0
fs/eventfd.c:201
RSP <ffff88003bcdfb50>
---[ end trace 9772f974e210aab6 ]---
Kernel panic - not syncing: Fatal exception
Shutting down cpus with NMI
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1

Dmitry Vyukov

unread,
Nov 12, 2016, 4:48:28 PM11/12/16
to Paolo Bonzini, rkr...@redhat.com, Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x...@kernel.org, KVM list, LKML, Steve Rutherford, syzkaller
Another use-after-free that looks relevant:

BUG: KASAN: use-after-free in insert_work+0x24a/0x2e0 at addr ffff88003d87bcd8
Read of size 8 by task syz-executor/28580
CPU: 0 PID: 28580 Comm: syz-executor Not tainted 4.9.0-rc4+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88003c60f920 ffffffff81c2e46b ffff88003e80ccc0 ffff88003d87bc38
ffff88003d87bf70 0000000000000000 ffff88003c60f948 ffffffff8165ab9c
ffffed0007b0f79b ffffed0007b0f79b ffff88003e80ccc0 ffff88003c60f9c8
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff81c2e46b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
[<ffffffff8165ab9c>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
[< inline >] print_address_description mm/kasan/report.c:194
[< inline >] kasan_report_error mm/kasan/report.c:283
[<ffffffff8165aed1>] kasan_report+0x231/0x500 mm/kasan/report.c:303
[<ffffffff8165b214>] __asan_report_load8_noabort+0x14/0x20
mm/kasan/report.c:329
[< inline >] constant_test_bit arch/x86/include/asm/bitops.h:311
[< inline >] set_work_data kernel/workqueue.c:614
[< inline >] set_work_pwq kernel/workqueue.c:621
[<ffffffff8128ca1a>] insert_work+0x24a/0x2e0 kernel/workqueue.c:1297
[<ffffffff8128cfa1>] __queue_work+0x4f1/0xed0 kernel/workqueue.c:1459
[<ffffffff8128e7f7>] queue_work_on+0x97/0xa0 kernel/workqueue.c:1484
[< inline >] queue_work include/linux/workqueue.h:474
[< inline >] schedule_work include/linux/workqueue.h:532
[< inline >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:403
[<ffffffff8106f18f>] kvm_irqfd+0x117f/0x18a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
[<ffffffff81065fe7>] kvm_vm_ioctl+0x2e7/0x1670
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2996
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff816b03cc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
[< inline >] SYSC_ioctl fs/ioctl.c:694
[<ffffffff816b130f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
[<ffffffff831f0dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Object at ffff88003d87bc38, in cache kmalloc-512 size: 512
Allocated:
PID = 28580
[ 956.676797] [<ffffffff811abb36>] save_stack_trace+0x16/0x20
arch/x86/kernel/stacktrace.c:57
[ 956.676797] [<ffffffff81659ee6>] save_stack+0x46/0xd0 mm/kasan/kasan.c:495
[ 956.676797] [< inline >] set_track mm/kasan/kasan.c:507
[ 956.676797] [<ffffffff8165a15d>] kasan_kmalloc+0xad/0xe0
mm/kasan/kasan.c:598
[ 956.676797] [<ffffffff816557f8>] kmem_cache_alloc_trace+0xf8/0x280
mm/slub.c:2735
[ 956.676797] [< inline >] kmalloc include/linux/slab.h:490
[ 956.676797] [< inline >] kzalloc include/linux/slab.h:636
[ 956.676797] [< inline >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:296
[ 956.676797] [<ffffffff8106e0b7>] kvm_irqfd+0xa7/0x18a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
[ 956.774974] [<ffffffff81065fe7>] kvm_vm_ioctl+0x2e7/0x1670
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2996
[ 956.779053] [< inline >] vfs_ioctl fs/ioctl.c:43
[ 956.779053] [<ffffffff816b03cc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
[ 956.779053] [< inline >] SYSC_ioctl fs/ioctl.c:694
[ 956.779053] [<ffffffff816b130f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
[ 956.779053] [<ffffffff831f0dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 12240
[ 956.779053] [<ffffffff811abb36>] save_stack_trace+0x16/0x20
arch/x86/kernel/stacktrace.c:57
[ 956.779053] [<ffffffff81659ee6>] save_stack+0x46/0xd0 mm/kasan/kasan.c:495
[ 956.779053] [< inline >] set_track mm/kasan/kasan.c:507
[ 956.779053] [<ffffffff8165a741>] kasan_slab_free+0x71/0xb0
mm/kasan/kasan.c:571
[ 956.779053] [< inline >] slab_free_hook mm/slub.c:1352
[ 956.779053] [< inline >] slab_free_freelist_hook mm/slub.c:1374
[ 956.779053] [< inline >] slab_free mm/slub.c:2951
[ 956.779053] [<ffffffff8165696a>] kfree+0xea/0x2c0 mm/slub.c:3871
[ 956.807057] [<ffffffff8106de2d>] irqfd_shutdown+0x13d/0x1a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:148
[ 956.807057] [<ffffffff8129175c>] process_one_work+0x9fc/0x1900
kernel/workqueue.c:2096
[ 956.807057] [<ffffffff8129274f>] worker_thread+0xef/0x1480
kernel/workqueue.c:2230
[ 956.807057] [<ffffffff812a5a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
[ 956.807057] [<ffffffff831f102a>] ret_from_fork+0x2a/0x40
arch/x86/entry/entry_64.S:433

Dmitry Vyukov

unread,
Nov 18, 2016, 3:17:26 AM11/18/16
to Paolo Bonzini, Radim Krčmář, Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x...@kernel.org, KVM list, LKML, Steve Rutherford, syzkaller
Another one:

BUG: KASAN: use-after-free in kvm_irqfd+0x188e/0x1940 at addr ffff880060af9100
Read of size 8 by task syz-executor/17548
CPU: 3 PID: 17548 Comm: syz-executor Not tainted 4.9.0-rc5+ #43
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88005f9ef5f0 ffffffff834c2a19 ffffffff00000003 1ffff1000bf3de51
ffffed000bf3de49 0000000041b58ab3 ffffffff895758b0 ffffffff834c272b
ffffffff894cff00 ffffffff81565d50 ffffffff894cff00 ffffffff81565d50
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff834c2a19>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51
[<ffffffff819f09b1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:159
[< inline >] print_address_description mm/kasan/report.c:197
[< inline >] kasan_report_error mm/kasan/report.c:286
[<ffffffff819f0c9b>] kasan_report+0x1eb/0x4c0 mm/kasan/report.c:306
[<ffffffff819f0fe9>] __asan_report_load8_noabort+0x19/0x20
mm/kasan/report.c:332
[< inline >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:412
[<ffffffff8108ee7e>] kvm_irqfd+0x188e/0x1940
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
[<ffffffff810839aa>] kvm_vm_ioctl+0x105a/0x1a70
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2998
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff81abcc04>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679
[< inline >] SYSC_ioctl fs/ioctl.c:694
[<ffffffff81abe104>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685
[<ffffffff88147905>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff880060af9000, in cache kmalloc-512 size: 512
Allocated:
PID = 17548
[ 514.149774] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20
arch/x86/kernel/stacktrace.c:57
[ 514.149774] [<ffffffff819efce3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:495
[ 514.149774] [< inline >] set_track mm/kasan/kasan.c:507
[ 514.149774] [<ffffffff819eff6d>] kasan_kmalloc+0xad/0xe0
mm/kasan/kasan.c:598
[ 514.149774] [<ffffffff819ec32c>]
kmem_cache_alloc_trace+0x12c/0x710 mm/slab.c:3635
[ 514.149774] [< inline >] kmalloc include/linux/slab.h:490
[ 514.149774] [< inline >] kzalloc include/linux/slab.h:636
[ 514.149774] [< inline >] kvm_irqfd_assign
arch/x86/kvm/../../../virt/kvm/eventfd.c:296
[ 514.149774] [<ffffffff8108d737>] kvm_irqfd+0x147/0x1940
arch/x86/kvm/../../../virt/kvm/eventfd.c:572
[ 514.149774] [<ffffffff810839aa>] kvm_vm_ioctl+0x105a/0x1a70
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2998
[ 514.149774] [< inline >] vfs_ioctl fs/ioctl.c:43
[ 514.149774] [<ffffffff81abcc04>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679
[ 514.149774] [< inline >] SYSC_ioctl fs/ioctl.c:694
[ 514.149774] [<ffffffff81abe104>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685
[ 514.149774] [<ffffffff88147905>] entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 4
[ 514.149774] [<ffffffff8127101b>] save_stack_trace+0x1b/0x20
arch/x86/kernel/stacktrace.c:57
[ 514.149774] [<ffffffff819efce3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:495
[ 514.149774] [< inline >] set_track mm/kasan/kasan.c:507
[ 514.149774] [<ffffffff819f05c2>] kasan_slab_free+0x72/0xc0
mm/kasan/kasan.c:571
[ 514.149774] [< inline >] __cache_free mm/slab.c:3511
[ 514.149774] [<ffffffff819ee228>] kfree+0xc8/0x2a0 mm/slab.c:3828
[ 514.149774] [<ffffffff8108d2c5>] irqfd_shutdown+0x155/0x1d0
arch/x86/kvm/../../../virt/kvm/eventfd.c:148
[ 514.149774] [<ffffffff81473050>] process_one_work+0xb40/0x1ba0
kernel/workqueue.c:2096
[ 514.149774] [<ffffffff814742c4>] worker_thread+0x214/0x18a0
kernel/workqueue.c:2230
[ 514.149774] [<ffffffff81489ee8>] kthread+0x328/0x3e0 kernel/kthread.c:209
[ 514.149774] [<ffffffff88147b9a>] ret_from_fork+0x2a/0x40
arch/x86/entry/entry_64.S:433
Memory state around the buggy address:
ffff880060af9000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880060af9080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff880060af9100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff880060af9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880060af9200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Reply all
Reply to author
Forward
0 new messages