[Devel] [PATCH RHEL7 COMMIT] ms/KVM: x86: fix NULL deref in vcpu_scan_ioapic

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-693.1.1.vz7.37.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.1.1.vz7.37.11
------>
commit b91e8841844275c283c71496abef66b3f292d2f7
Author: Wanpeng Li <wanpeng.li at hotmail.com>
Date:   Thu Oct 12 11:20:49 2017 +0300

    ms/KVM: x86: fix NULL deref in vcpu_scan_ioapic
    
    Patchset description:
    kvm: hyperv: backport latest stuff from mainstream
    
    These are backports of the latest commits to hyperv subsystem in
    mainsteram KVM (as of 4.13).  They address a couple of design flaws, and
    are necessary for the latest hyperv code in QEMU to work properly.
    
    v1 -> v2:
     - replace incremental patch with a revert and a fresh backport
     - pull in an intermediate upstream patch to minimize conflicts
    
    Roman Kagan (3):
      Revert "kvm/x86: clear hyperv synic pages only when guest modifies
        MSRs"
      kvm: x86: hyperv: add KVM_CAP_HYPERV_SYNIC2
      kvm: x86: hyperv: make VP_INDEX managed by userspace
    
    Wanpeng Li (1):
      KVM: x86: fix NULL deref in vcpu_scan_ioapic
    
    ============================================
    This patch description:
    
    Reported by syzkaller:
    
        BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0
        IP: _raw_spin_lock+0xc/0x30
        PGD 3e28eb067
        PUD 3f0ac6067
        PMD 0
        Oops: 0002 [#1] SMP
        CPU: 0 PID: 2431 Comm: test Tainted: G           OE   4.10.0-rc1+ #3
        Call Trace:
         ? kvm_ioapic_scan_entry+0x3e/0x110 [kvm]
         kvm_arch_vcpu_ioctl_run+0x10a8/0x15f0 [kvm]
         ? pick_next_task_fair+0xe1/0x4e0
         ? kvm_arch_vcpu_load+0xea/0x260 [kvm]
         kvm_vcpu_ioctl+0x33a/0x600 [kvm]
         ? hrtimer_try_to_cancel+0x29/0x130
         ? do_nanosleep+0x97/0xf0
         do_vfs_ioctl+0xa1/0x5d0
         ? __hrtimer_init+0x90/0x90
         ? do_nanosleep+0x5b/0xf0
         SyS_ioctl+0x79/0x90
         do_syscall_64+0x6e/0x180
         entry_SYSCALL64_slow_path+0x25/0x25
        RIP: _raw_spin_lock+0xc/0x30 RSP: ffffa43688973cc0
    
    The syzkaller folks reported a NULL pointer dereference due to
    ENABLE_CAP succeeding even without an irqchip.  The Hyper-V
    synthetic interrupt controller is activated, resulting in a
    wrong request to rescan the ioapic and a NULL pointer dereference.
    
        #include <sys/ioctl.h>
        #include <sys/mman.h>
        #include <sys/types.h>
        #include <linux/kvm.h>
        #include <pthread.h>
        #include <stddef.h>
        #include <stdint.h>
        #include <stdlib.h>
        #include <string.h>
        #include <unistd.h>
    
        #ifndef KVM_CAP_HYPERV_SYNIC
        #define KVM_CAP_HYPERV_SYNIC 123
        #endif
    
        void* thr(void* arg)
        {
    	struct kvm_enable_cap cap;
    	cap.flags = 0;
    	cap.cap = KVM_CAP_HYPERV_SYNIC;
    	ioctl((long)arg, KVM_ENABLE_CAP, &cap);
    	return 0;
        }
    
        int main()
        {
    	void *host_mem = mmap(0, 0x1000, PROT_READ|PROT_WRITE,
    			MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
    	int kvmfd = open("/dev/kvm", 0);
    	int vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
    	struct kvm_userspace_memory_region memreg;
    	memreg.slot = 0;
    	memreg.flags = 0;
    	memreg.guest_phys_addr = 0;
    	memreg.memory_size = 0x1000;
    	memreg.userspace_addr = (unsigned long)host_mem;
    	host_mem[0] = 0xf4;
    	ioctl(vmfd, KVM_SET_USER_MEMORY_REGION, &memreg);
    	int cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
    	struct kvm_sregs sregs;
    	ioctl(cpufd, KVM_GET_SREGS, &sregs);
    	sregs.cr0 = 0;
    	sregs.cr4 = 0;
    	sregs.efer = 0;
    	sregs.cs.selector = 0;
    	sregs.cs.base = 0;
    	ioctl(cpufd, KVM_SET_SREGS, &sregs);
    	struct kvm_regs regs = { .rflags = 2 };
    	ioctl(cpufd, KVM_SET_REGS, &regs);
    	ioctl(vmfd, KVM_CREATE_IRQCHIP, 0);
    	pthread_t th;
    	pthread_create(&th, 0, thr, (void*)(long)cpufd);
    	usleep(rand() % 10000);
    	ioctl(cpufd, KVM_RUN, 0);
    	pthread_join(th, 0);
    	return 0;
        }
    
    This patch fixes it by failing ENABLE_CAP if without an irqchip.
    
    Reported-by: Dmitry Vyukov <dvyukov at google.com>
    Fixes: 5c919412fe61 (kvm/x86: Hyper-V synthetic interrupt controller)
    Cc: stable at vger.kernel.org # 4.5+
    Cc: Paolo Bonzini <pbonzini at redhat.com>
    Cc: Radim Krčmář <rkrcmar at redhat.com>
    Cc: Dmitry Vyukov <dvyukov at google.com>
    Signed-off-by: Wanpeng Li <wanpeng.li at hotmail.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    
    (cherry picked from commit 546d87e5c903a7f3ee7b9f998949a94729fbc65b)
    Signed-off-by: Roman Kagan <rkagan at virtuozzo.com>
---
 arch/x86/kvm/x86.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 478faf1..16a8aa0 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3296,6 +3296,8 @@ static int kvm_vcpu_ioctl_enable_cap(struct kvm_vcpu *vcpu,
 
 	switch (cap->cap) {
 	case KVM_CAP_HYPERV_SYNIC:
+		if (!irqchip_in_kernel(vcpu->kvm))
+			return -EINVAL;
 		return kvm_hv_activate_synic(vcpu);
 	default:
 		return -EINVAL;