Si-Wei Liu
2023-Oct-23 23:14 UTC
[PATCH] vhost-vdpa: fix NULL pointer deref in _compat_vdpa_reset
As subject. There's a vhost_vdpa_reset() done earlier before
vhost_dev is initialized via vhost_dev_init(), ending up with
NULL pointer dereference. Fix is to check if vqs is initialized
before checking backend features and resetting the device.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP
CPU: 3 PID: 1727 Comm: qemu-system-x86 Not tainted 6.6.0-rc6+ #2
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-
a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:_compat_vdpa_reset+0x47/0xc0 [vhost_vdpa]
Code: c7 c7 fb 12 56 a0 4c 8d a5 b8 02 00 00 48 89 ea e8 7e b8 c4
48 89 ee 48 c7 c7 19 13 56 a0 4c 8b ad b0 02 00 00 <48> 8b 00 49
00 48 8b 80 88 45 00 00 48 c1 e8 08 48
RSP: 0018:ffff8881063c3c38 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8881074eb800 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888103ab4000 RDI: ffffffffa0561319
RBP: ffff888103ab4000 R08: 00000000ffffdfff R09: 0000000000000001
R10: 0000000000000003 R11: ffff88887fecbac0 R12: ffff888103ab42b8
R13: ffff888106dbe850 R14: 0000000000000003 R15: ffff8881074ebc18
FS: 00007f02fba6ef00(0000) GS:ffff88885f8c0000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001325e5003 CR4: 0000000000372ea0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
? __die+0x1f/0x60
? page_fault_oops+0x14c/0x3b0
? exc_page_fault+0x74/0x140
? asm_exc_page_fault+0x22/0x30
? _compat_vdpa_reset+0x47/0xc0 [vhost_vdpa]
? _compat_vdpa_reset+0x32/0xc0 [vhost_vdpa]
vhost_vdpa_open+0x55/0x270 [vhost_vdpa]
? sb_init_dio_done_wq+0x50/0x50
chrdev_open+0xc0/0x210
? __unregister_chrdev+0x50/0x50
do_dentry_open+0x1fc/0x4f0
path_openat+0xc2d/0xf20
do_filp_open+0xb4/0x160
? kmem_cache_alloc+0x3c/0x490
do_sys_openat2+0x8d/0xc0
__x64_sys_openat+0x6a/0xa0
do_syscall_64+0x3c/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Fixes: 10cbf8dfaf93 ("vhost-vdpa: clean iotlb map during reset for older
userspace")
Reported-by: Dragos Tatulea <dtatulea at nvidia.com>
Closes: https://lore.kernel.org/all/b4913f84-8b52-4d28-af51-8573dc361f82 at
oracle.com/
Signed-off-by: Si-Wei Liu <si-wei.liu at oracle.com>
---
drivers/vhost/vdpa.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index 9ce40003793b..9a2343c45df0 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -232,9 +232,11 @@ static int _compat_vdpa_reset(struct vhost_vdpa *v)
struct vdpa_device *vdpa = v->vdpa;
u32 flags = 0;
- flags |= !vhost_backend_has_feature(v->vdev.vqs[0],
- VHOST_BACKEND_F_IOTLB_PERSIST) ?
- VDPA_RESET_F_CLEAN_MAP : 0;
+ if (v->vdev.vqs) {
+ flags |= !vhost_backend_has_feature(v->vdev.vqs[0],
+ VHOST_BACKEND_F_IOTLB_PERSIST) ?
+ VDPA_RESET_F_CLEAN_MAP : 0;
+ }
return vdpa_reset(vdpa, flags);
}
--
2.39.3
Dragos Tatulea
2023-Oct-24 07:49 UTC
[PATCH] vhost-vdpa: fix NULL pointer deref in _compat_vdpa_reset
On Mon, 2023-10-23 at 16:14 -0700, Si-Wei Liu wrote:> As subject. There's a vhost_vdpa_reset() done earlier before > vhost_dev is initialized via vhost_dev_init(), ending up with > NULL pointer dereference. Fix is to check if vqs is initialized > before checking backend features and resetting the device. > > ? BUG: kernel NULL pointer dereference, address: 0000000000000000 > ? #PF: supervisor read access in kernel mode > ? #PF: error_code(0x0000) - not-present page > ? PGD 0 P4D 0 > ? Oops: 0000 [#1] SMP > ? CPU: 3 PID: 1727 Comm: qemu-system-x86 Not tainted 6.6.0-rc6+ #2 > ? Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel- > ? a4aeb02-prebuilt.qemu.org 04/01/2014 > ? RIP: 0010:_compat_vdpa_reset+0x47/0xc0 [vhost_vdpa] > ? Code: c7 c7 fb 12 56 a0 4c 8d a5 b8 02 00 00 48 89 ea e8 7e b8 c4 > ? 48 89 ee 48 c7 c7 19 13 56 a0 4c 8b ad b0 02 00 00 <48> 8b 00 49 > ? 00 48 8b 80 88 45 00 00 48 c1 e8 08 48 > ? RSP: 0018:ffff8881063c3c38 EFLAGS: 00010246 > ? RAX: 0000000000000000 RBX: ffff8881074eb800 RCX: 0000000000000000 > ? RDX: 0000000000000000 RSI: ffff888103ab4000 RDI: ffffffffa0561319 > ? RBP: ffff888103ab4000 R08: 00000000ffffdfff R09: 0000000000000001 > ? R10: 0000000000000003 R11: ffff88887fecbac0 R12: ffff888103ab42b8 > ? R13: ffff888106dbe850 R14: 0000000000000003 R15: ffff8881074ebc18 > ? FS:? 00007f02fba6ef00(0000) GS:ffff88885f8c0000(0000) > ? knlGS:0000000000000000 > ? CS:? 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > ? CR2: 0000000000000000 CR3: 00000001325e5003 CR4: 0000000000372ea0 > ? DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > ? DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > ? Call Trace: > ?? <TASK> > ?? ? __die+0x1f/0x60 > ?? ? page_fault_oops+0x14c/0x3b0 > ?? ? exc_page_fault+0x74/0x140 > ?? ? asm_exc_page_fault+0x22/0x30 > ?? ? _compat_vdpa_reset+0x47/0xc0 [vhost_vdpa] > ?? ? _compat_vdpa_reset+0x32/0xc0 [vhost_vdpa] > ?? vhost_vdpa_open+0x55/0x270 [vhost_vdpa] > ?? ? sb_init_dio_done_wq+0x50/0x50 > ?? chrdev_open+0xc0/0x210 > ?? ? __unregister_chrdev+0x50/0x50 > ?? do_dentry_open+0x1fc/0x4f0 > ?? path_openat+0xc2d/0xf20 > ?? do_filp_open+0xb4/0x160 > ?? ? kmem_cache_alloc+0x3c/0x490 > ?? do_sys_openat2+0x8d/0xc0 > ?? __x64_sys_openat+0x6a/0xa0 > ?? do_syscall_64+0x3c/0x80 > ?? entry_SYSCALL_64_after_hwframe+0x46/0xb0 > > Fixes: 10cbf8dfaf93 ("vhost-vdpa: clean iotlb map during reset for older > userspace") > Reported-by: Dragos Tatulea <dtatulea at nvidia.com>This works, thanks for the quick response. Tested-by: Dragos Tatulea <dtatulea at nvidia.com>> Closes: > https://lore.kernel.org/all/b4913f84-8b52-4d28-af51-8573dc361f82 at oracle.com/ > Signed-off-by: Si-Wei Liu <si-wei.liu at oracle.com> > --- > ?drivers/vhost/vdpa.c | 8 +++++--- > ?1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c > index 9ce40003793b..9a2343c45df0 100644 > --- a/drivers/vhost/vdpa.c > +++ b/drivers/vhost/vdpa.c > @@ -232,9 +232,11 @@ static int _compat_vdpa_reset(struct vhost_vdpa *v) > ????????struct vdpa_device *vdpa = v->vdpa; > ????????u32 flags = 0; > ? > -???????flags |= !vhost_backend_has_feature(v->vdev.vqs[0], > -?????????????????????????????????????????? VHOST_BACKEND_F_IOTLB_PERSIST) ? > -??????????????? VDPA_RESET_F_CLEAN_MAP : 0; > +???????if (v->vdev.vqs) { > +???????????????flags |= !vhost_backend_has_feature(v->vdev.vqs[0], > +?????????????????????????????????????????????????? > VHOST_BACKEND_F_IOTLB_PERSIST) ? > +??????????????????????? VDPA_RESET_F_CLEAN_MAP : 0; > +???????} > ? > ????????return vdpa_reset(vdpa, flags); > ?}