WARNING: bad usercopy in __kvm_write_guest_page

[syzbot]

Hello,

syzbot hit the following crash on upstream commit
e2c15aff5f353ba80bd3bb49840837f65fa5cc43 (Thu Mar 15 18:07:35 2018 +0000)
Merge tag 'sound-4.16-rc6' of
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Unfortunately, I don't have any reproducer for this crash yet.
Raw console output is attached.
compiler: gcc (GCC) 7.1.1 20170620
.config is attached.
CC: [james...@arm.com kees...@chromium.org keun-...@darkmatter.ae
lab...@redhat.com linux-...@vger.kernel.org linu...@kvack.org
mark.r...@arm.com]

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e4a2f5...@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
------------[ cut here ]------------
Bad or missing usercopy whitelist? Kernel memory exposure attempt detected
from SLAB object 'kvm_vcpu' (offset 23192, size 8)!
WARNING: CPU: 0 PID: 5529 at mm/usercopy.c:81 usercopy_warn+0xdb/0x100
mm/usercopy.c:76
Kernel panic - not syncing: panic_on_warn set ...

IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
CPU: 0 PID: 5529 Comm: syz-executor1 Not tainted 4.16.0-rc5+ #355
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1dc/0x200 kernel/panic.c:547
IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
report_bug+0x1f4/0x2b0 lib/bug.c:186
fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
fixup_bug arch/x86/kernel/traps.c:247 [inline]
do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:986
RIP: 0010:usercopy_warn+0xdb/0x100 mm/usercopy.c:76
RSP: 0018:ffff8801bbc7f108 EFLAGS: 00010282
RAX: dffffc0000000008 RBX: ffffffff86c67f7f RCX: ffffffff815acd3e
RDX: 0000000000005d74 RSI: ffffc90002536000 RDI: 1ffff1003778fda6
RBP: ffff8801bbc7f160 R08: 1ffff1003778fd68 R09: 0000000000000000
R10: 0000000000002070 R11: 0000000000000000 R12: ffffffff86217a40
R13: ffffffff86321f80 R14: 0000000000005a98 R15: 0000000000000008
__check_heap_object+0x89/0xc0 mm/slab.c:4426
check_heap_object mm/usercopy.c:236 [inline]
__check_object_size+0x272/0x530 mm/usercopy.c:259
check_object_size include/linux/thread_info.h:112 [inline]
__copy_to_user include/linux/uaccess.h:104 [inline]
__kvm_write_guest_page+0x7f/0x130
arch/x86/kvm/../../../virt/kvm/kvm_main.c:1828
kvm_vcpu_write_guest_page arch/x86/kvm/../../../virt/kvm/kvm_main.c:1849
[inline]
kvm_vcpu_write_guest+0x65/0xc0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:1883
kvm_write_guest_virt_system+0x7f/0x150 arch/x86/kvm/x86.c:4759
handle_vmptrst+0x188/0x200 arch/x86/kvm/vmx.c:7929
vmx_handle_exit+0x25d/0x1ce0 arch/x86/kvm/vmx.c:8965
vcpu_enter_guest arch/x86/kvm/x86.c:7320 [inline]
vcpu_run arch/x86/kvm/x86.c:7382 [inline]
kvm_arch_vcpu_ioctl_run+0x1c93/0x5c80 arch/x86/kvm/x86.c:7549
kvm_vcpu_ioctl+0x6f1/0xff0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2560
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x453e69
RSP: 002b:00007f66930dac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f66930db6d4 RCX: 0000000000453e69
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000016
RBP: 000000000072c010 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 000000000000024a R14: 00000000006f3790 R15: 0000000000000002
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.16.0-rc5+ #355
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:76
RSP: 0018:ffff8801db307e88 EFLAGS: 00010086
RAX: dffffc0000000000 RBX: 00000000001606e0 RCX: 0000000000000001
RDX: 1ffffffff0dd935c RSI: 0000000000000000 RDI: 00000000001606e0
RBP: ffff8801db307e88 R08: ffff8801db307f40 R09: ffff8801db307f80
R10: ffff88021fff8050 R11: ffff88021fff805d R12: 0000000000000082
R13: 1ffff1003b660fd4 R14: ffff8801d9b12300 R15: ffff8801db307fc0
FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000a44a40 CR3: 0000000006e22006 CR4: 00000000001626e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__write_cr4 arch/x86/include/asm/paravirt.h:77 [inline]
__cr4_set arch/x86/include/asm/tlbflush.h:254 [inline]
cr4_clear_bits arch/x86/include/asm/tlbflush.h:277 [inline]
cpu_vmxoff arch/x86/include/asm/virtext.h:44 [inline]
__cpu_emergency_vmxoff arch/x86/include/asm/virtext.h:59 [inline]
cpu_emergency_vmxoff arch/x86/include/asm/virtext.h:67 [inline]
smp_reboot_interrupt+0x3ea/0x510 arch/x86/kernel/smp.c:179
reboot_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:850
</IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
RSP: 0018:ffff8801d9b1fcb0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff07
RAX: dffffc0000000000 RBX: 1ffff1003b363f99 RCX: ffffffff840fd025
RDX: 1ffffffff0dd9380 RSI: 0000000000000001 RDI: ffffffff86ec9c00
RBP: ffff8801d9b1fcb0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8801d9b1fd68 R14: ffffffff876e7e20 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
default_idle+0xbf/0x430 arch/x86/kernel/process.c:354
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:345
default_idle_call+0x36/0x90 kernel/sched/idle.c:98
cpuidle_idle_call kernel/sched/idle.c:156 [inline]
do_idle+0x24a/0x3b0 kernel/sched/idle.c:246
cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:351
start_secondary+0x40a/0x590 arch/x86/kernel/smpboot.c:267
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:239
Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 00 00
55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> 22 e7 5d
c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d
RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:76 RSP:
ffff8801db307e88
---[ end trace 09711cabb03cb058 ]---
Shutting down cpus with NMI
invalid opcode: 0000 [#2] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G D 4.16.0-rc5+ #355
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:smp_stop_nmi_callback+0x279/0x560 arch/x86/kernel/smp.c:170
RSP: 0018:fffffe000003bb40 EFLAGS: 00010002
RAX: 00000000001626e0 RBX: 1fffffc000007769 RCX: 0000000000000020
RDX: dffffc0000000000 RSI: fffffe000003bbe8 RDI: fffffe000003bba8
RBP: fffffe000003bcd0 R08: fffffe000003bc28 R09: fffffe000003bc68
R10: ffff88021fff8050 R11: ffff88021fff805d R12: 1fffffc000007785
R13: fffffe000003bca8 R14: 1fffffc000007775 R15: 1fffffc00000777d
FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000a44a40 CR3: 0000000006e22006 CR4: 00000000001626e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
nmi_handle+0x23b/0x5f0 arch/x86/kernel/nmi.c:137
default_do_nmi+0x6d/0x150 arch/x86/kernel/nmi.c:335
do_nmi+0x205/0x2c0 arch/x86/kernel/nmi.c:521
end_repeat_nmi+0x16/0x1a
RIP: 0010:panic_smp_self_stop+0xb/0x80
RSP: 0018:ffff8801db307c68 EFLAGS: 00000006
RAX: ffff8801d9b12300 RBX: ffffffff86c4488b RCX: ffffffff8141a0e9
RDX: 0000000000010000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff8801db307c68 R08: 0000000000000000 R09: 1ffff1003b660f68
R10: ffff8801db307d40 R11: ffffffff86f42dc0 R12: ffff8801db307d40
R13: ffff8801db307d00 R14: dffffc0000000000 R15: 0000000000000000
</NMI>
<IRQ>
panic+0xec/0x41c kernel/panic.c:170
oops_end+0xd2/0xe0 arch/x86/kernel/dumpstack.c:293
die+0x3d/0x50 arch/x86/kernel/dumpstack.c:356
do_general_protection+0x34e/0x3e0 arch/x86/kernel/traps.c:560
general_protection+0x25/0x50 arch/x86/entry/entry_64.S:1150
RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:76
RSP: 0018:ffff8801db307e88 EFLAGS: 00010086
RAX: dffffc0000000000 RBX: 00000000001606e0 RCX: 0000000000000001
RDX: 1ffffffff0dd935c RSI: 0000000000000000 RDI: 00000000001606e0
RBP: ffff8801db307e88 R08: ffff8801db307f40 R09: ffff8801db307f80
R10: ffff88021fff8050 R11: ffff88021fff805d R12: 0000000000000082
R13: 1ffff1003b660fd4 R14: ffff8801d9b12300 R15: ffff8801db307fc0
__write_cr4 arch/x86/include/asm/paravirt.h:77 [inline]
__cr4_set arch/x86/include/asm/tlbflush.h:254 [inline]
cr4_clear_bits arch/x86/include/asm/tlbflush.h:277 [inline]
cpu_vmxoff arch/x86/include/asm/virtext.h:44 [inline]
__cpu_emergency_vmxoff arch/x86/include/asm/virtext.h:59 [inline]
cpu_emergency_vmxoff arch/x86/include/asm/virtext.h:67 [inline]
smp_reboot_interrupt+0x3ea/0x510 arch/x86/kernel/smp.c:179
reboot_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:850
</IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
RSP: 0018:ffff8801d9b1fcb0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff07
RAX: dffffc0000000000 RBX: 1ffff1003b363f99 RCX: ffffffff840fd025
RDX: 1ffffffff0dd9380 RSI: 0000000000000001 RDI: ffffffff86ec9c00
RBP: ffff8801d9b1fcb0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8801d9b1fd68 R14: ffffffff876e7e20 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
default_idle+0xbf/0x430 arch/x86/kernel/process.c:354
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:345
default_idle_call+0x36/0x90 kernel/sched/idle.c:98
cpuidle_idle_call kernel/sched/idle.c:156 [inline]
do_idle+0x24a/0x3b0 kernel/sched/idle.c:246
cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:351
start_secondary+0x40a/0x590 arch/x86/kernel/smpboot.c:267
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:239
Code: 00 00 00 00 48 83 e7 f8 48 29 fb 8d 4b 2c c1 e9 03 f3 48 ab 48 81 c4
68 01 00 00 b8 01 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 01 c4 48
c7 c7 e0 9b ec 86 48 89 f8 48 c1 e8 03 80 3c 10 00
RIP: smp_stop_nmi_callback+0x279/0x560 arch/x86/kernel/smp.c:170 RSP:
fffffe000003bb40
Dumping ftrace buffer:
---[ end trace 09711cabb03cb059 ]---
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.
To upstream this report, please reply with:
#syz upstream

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 2c71d338bef2 Merge tag 'powerpc-4.17-6' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=164307cf800000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3b4e30da84ec1ed
dashboard link: https://syzkaller.appspot.com/bug?extid=e4a2f5cf24505e853f01
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=17b285a7800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10b84bcf800000
CC: [kees...@chromium.org linux-...@vger.kernel.org
linu...@kvack.org]

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e4a2f5...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)

------------[ cut here ]------------
Bad or missing usercopy whitelist? Kernel memory exposure attempt detected
from SLAB object 'kvm_vcpu' (offset 23192, size 8)!

WARNING: CPU: 0 PID: 4534 at mm/usercopy.c:81 usercopy_warn+0xf5/0x120

mm/usercopy.c:76
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 4534 Comm: syz-executor298 Not tainted 4.17.0-rc5+ #57

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
panic+0x22f/0x4de kernel/panic.c:184
__warn.cold.8+0x163/0x1b3 kernel/panic.c:536
report_bug+0x252/0x2d0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x1de/0x490 arch/x86/kernel/traps.c:296
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:usercopy_warn+0xf5/0x120 mm/usercopy.c:76
RSP: 0018:ffff8801afabf0b0 EFLAGS: 00010286
RAX: 000000000000007e RBX: ffffffff889d52f0 RCX: ffffffff8160aa5d
RDX: 0000000000000000 RSI: ffffffff8160f711 RDI: ffff8801afabec10
RBP: ffff8801afabf110 R08: ffff8801ae7f42c0 R09: 0000000000000006
R10: ffff8801ae7f42c0 R11: 0000000000000000 R12: ffffffff87d2fa60
R13: ffffffff87c19ec0 R14: 0000000000000000 R15: 0000000000000008
__check_heap_object+0x89/0xb5 mm/slab.c:4440
check_heap_object mm/usercopy.c:236 [inline]
__check_object_size+0x4c7/0x5d9 mm/usercopy.c:259
check_object_size include/linux/thread_info.h:108 [inline]
__copy_to_user include/linux/uaccess.h:104 [inline]
__kvm_write_guest_page+0x90/0x140

arch/x86/kvm/../../../virt/kvm/kvm_main.c:1828
kvm_vcpu_write_guest_page arch/x86/kvm/../../../virt/kvm/kvm_main.c:1849
[inline]

kvm_vcpu_write_guest+0x65/0xe0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:1883
kvm_write_guest_virt_system+0x8a/0x190 arch/x86/kvm/x86.c:4843
handle_vmptrst+0x1d2/0x260 arch/x86/kvm/vmx.c:8196
vmx_handle_exit+0x2c0/0x17b0 arch/x86/kvm/vmx.c:9234
vcpu_enter_guest+0x13af/0x6060 arch/x86/kvm/x86.c:7503
vcpu_run arch/x86/kvm/x86.c:7565 [inline]
kvm_arch_vcpu_ioctl_run+0x33e/0x1690 arch/x86/kvm/x86.c:7742
kvm_vcpu_ioctl+0x79d/0x12e0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2560
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1cf/0x16a0 fs/ioctl.c:684
ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
__do_sys_ioctl fs/ioctl.c:708 [inline]
__se_sys_ioctl fs/ioctl.c:706 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x443039
RSP: 002b:00007ffe00412648 EFLAGS: 00000286 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000443039
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00000000006cd018 R08: 0000000020000580 R09: 0000000020000580
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000404080
R13: 0000000000404110 R14: 0000000000000000 R15: 0000000000000000

Dumping ftrace buffer:
(ftrace buffer empty)

[Dmitry Vyukov]

#syz upstream

> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-upstream-moderation/000000000000af55200567cf41b1%40google.com.
> For more options, visit https://groups.google.com/d/optout.