From: Dragos Tatulea <dtatulea@nvidia•com>
To: "sfr@canb•auug.org.au" <sfr@canb•auug.org.au>,
"si-wei.liu@oracle•com" <si-wei.liu@oracle•com>,
"jasowang@redhat•com" <jasowang@redhat•com>,
"mst@redhat•com" <mst@redhat•com>,
"virtualization@lists•linux-foundation.org"
<virtualization@lists•linux-foundation.org>
Cc: "linux-next@vger•kernel.org" <linux-next@vger•kernel.org>,
"linux-kernel@vger•kernel.org" <linux-kernel@vger•kernel.org>
Subject: Re: [PATCH] vhost-vdpa: fix NULL pointer deref in _compat_vdpa_reset
Date: Tue, 24 Oct 2023 07:49:14 +0000 [thread overview]
Message-ID: <c72ed78afaa8c1de803d3b4bd6624cbc032e7d4f.camel@nvidia.com> (raw)
In-Reply-To: <1698102863-21122-1-git-send-email-si-wei.liu@oracle.com>
On Mon, 2023-10-23 at 16:14 -0700, Si-Wei Liu wrote:
> As subject. There's a vhost_vdpa_reset() done earlier before
> vhost_dev is initialized via vhost_dev_init(), ending up with
> NULL pointer dereference. Fix is to check if vqs is initialized
> before checking backend features and resetting the device.
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 0 P4D 0
> Oops: 0000 [#1] SMP
> CPU: 3 PID: 1727 Comm: qemu-system-x86 Not tainted 6.6.0-rc6+ #2
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-
> a4aeb02-prebuilt.qemu.org 04/01/2014
> RIP: 0010:_compat_vdpa_reset+0x47/0xc0 [vhost_vdpa]
> Code: c7 c7 fb 12 56 a0 4c 8d a5 b8 02 00 00 48 89 ea e8 7e b8 c4
> 48 89 ee 48 c7 c7 19 13 56 a0 4c 8b ad b0 02 00 00 <48> 8b 00 49
> 00 48 8b 80 88 45 00 00 48 c1 e8 08 48
> RSP: 0018:ffff8881063c3c38 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff8881074eb800 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: ffff888103ab4000 RDI: ffffffffa0561319
> RBP: ffff888103ab4000 R08: 00000000ffffdfff R09: 0000000000000001
> R10: 0000000000000003 R11: ffff88887fecbac0 R12: ffff888103ab42b8
> R13: ffff888106dbe850 R14: 0000000000000003 R15: ffff8881074ebc18
> FS: 00007f02fba6ef00(0000) GS:ffff88885f8c0000(0000)
> knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000000 CR3: 00000001325e5003 CR4: 0000000000372ea0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> ? __die+0x1f/0x60
> ? page_fault_oops+0x14c/0x3b0
> ? exc_page_fault+0x74/0x140
> ? asm_exc_page_fault+0x22/0x30
> ? _compat_vdpa_reset+0x47/0xc0 [vhost_vdpa]
> ? _compat_vdpa_reset+0x32/0xc0 [vhost_vdpa]
> vhost_vdpa_open+0x55/0x270 [vhost_vdpa]
> ? sb_init_dio_done_wq+0x50/0x50
> chrdev_open+0xc0/0x210
> ? __unregister_chrdev+0x50/0x50
> do_dentry_open+0x1fc/0x4f0
> path_openat+0xc2d/0xf20
> do_filp_open+0xb4/0x160
> ? kmem_cache_alloc+0x3c/0x490
> do_sys_openat2+0x8d/0xc0
> __x64_sys_openat+0x6a/0xa0
> do_syscall_64+0x3c/0x80
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
>
> Fixes: 10cbf8dfaf93 ("vhost-vdpa: clean iotlb map during reset for older
> userspace")
> Reported-by: Dragos Tatulea <dtatulea@nvidia•com>
This works, thanks for the quick response.
Tested-by: Dragos Tatulea <dtatulea@nvidia•com>
> Closes:
> https://lore.kernel.org/all/b4913f84-8b52-4d28-af51-8573dc361f82@oracle.com/
> Signed-off-by: Si-Wei Liu <si-wei.liu@oracle•com>
> ---
> drivers/vhost/vdpa.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index 9ce40003793b..9a2343c45df0 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -232,9 +232,11 @@ static int _compat_vdpa_reset(struct vhost_vdpa *v)
> struct vdpa_device *vdpa = v->vdpa;
> u32 flags = 0;
>
> - flags |= !vhost_backend_has_feature(v->vdev.vqs[0],
> - VHOST_BACKEND_F_IOTLB_PERSIST) ?
> - VDPA_RESET_F_CLEAN_MAP : 0;
> + if (v->vdev.vqs) {
> + flags |= !vhost_backend_has_feature(v->vdev.vqs[0],
> +
> VHOST_BACKEND_F_IOTLB_PERSIST) ?
> + VDPA_RESET_F_CLEAN_MAP : 0;
> + }
>
> return vdpa_reset(vdpa, flags);
> }
prev parent reply other threads:[~2023-10-24 7:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-23 23:14 [PATCH] vhost-vdpa: fix NULL pointer deref in _compat_vdpa_reset Si-Wei Liu
2023-10-24 7:49 ` Dragos Tatulea [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c72ed78afaa8c1de803d3b4bd6624cbc032e7d4f.camel@nvidia.com \
--to=dtatulea@nvidia$(echo .)com \
--cc=jasowang@redhat$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-next@vger$(echo .)kernel.org \
--cc=mst@redhat$(echo .)com \
--cc=sfr@canb$(echo .)auug.org.au \
--cc=si-wei.liu@oracle$(echo .)com \
--cc=virtualization@lists$(echo .)linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox