syzbot

 sign-in | mailing list | source | docs
🐞 Open [994] ≡ Subsystems 🐞 Fixed [5244] 🐞 Invalid [12516] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KMSAN: kernel-infoleak in kvm_write_guest_page

Status: fixed on 2018/12/07 08:24
Subsystems: kvm
[Documentation on labels]
Reported-by: syzbot+a8ef68d71211ba264f56@syzkaller.appspotmail.com
Fix commit: bcbfbd8ec210 KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall
First crash: 2020d, last: 1970d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH 4.19 000/139] 4.19.7-stable review 156 (156) 2018/12/13 02:21
[PATCH 4.14 000/146] 4.14.86-stable review 160 (160) 2018/12/05 23:53
KMSAN: kernel-infoleak in kvm_write_guest_page 1 (2) 2018/11/07 22:13

Sample crash report:
L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.
==================================================================
BUG: KMSAN: kernel-infoleak in __copy_to_user include/linux/uaccess.h:121 [inline]
BUG: KMSAN: kernel-infoleak in __kvm_write_guest_page arch/x86/kvm/../../../virt/kvm/kvm_main.c:1849 [inline]
BUG: KMSAN: kernel-infoleak in kvm_write_guest_page+0x373/0x500 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1861
CPU: 1 PID: 6274 Comm: syz-executor149 Not tainted 4.19.0+ #78
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x32d/0x480 lib/dump_stack.c:113
 kmsan_report+0x19f/0x300 mm/kmsan/kmsan.c:911
 kmsan_internal_check_memory+0x35f/0x450 mm/kmsan/kmsan.c:993
 kmsan_copy_to_user+0x7c/0xe0 mm/kmsan/kmsan_hooks.c:552
 __copy_to_user include/linux/uaccess.h:121 [inline]
 __kvm_write_guest_page arch/x86/kvm/../../../virt/kvm/kvm_main.c:1849 [inline]
 kvm_write_guest_page+0x373/0x500 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1861
 kvm_write_guest+0x1e1/0x360 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1883
 kvm_pv_clock_pairing arch/x86/kvm/x86.c:6793 [inline]
 kvm_emulate_hypercall+0x1c96/0x21b0 arch/x86/kvm/x86.c:6866
 handle_vmcall+0x41/0x50 arch/x86/kvm/vmx.c:7487
 vmx_handle_exit+0x1e81/0xbac0 arch/x86/kvm/vmx.c:10128
 vcpu_enter_guest arch/x86/kvm/x86.c:7667 [inline]
 vcpu_run arch/x86/kvm/x86.c:7730 [inline]
 kvm_arch_vcpu_ioctl_run+0xac32/0x11d80 arch/x86/kvm/x86.c:7930
 kvm_vcpu_ioctl+0xfb1/0x1f90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2590
 do_vfs_ioctl+0xf77/0x2d30 fs/ioctl.c:46
 ksys_ioctl fs/ioctl.c:702 [inline]
 __do_sys_ioctl fs/ioctl.c:709 [inline]
 __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:707
 __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:707
 do_syscall_64+0xcf/0x110 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x442b39
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 0c fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffcb4e05478 EFLAGS: 00000217 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000442b39
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007
RBP: 00000000006cd018 R08: 0000000020000100 R09: 0000000020000100
R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000403be0
R13: 0000000000403c70 R14: 0000000000000000 R15: 0000000000000000

Local variable description: ----clock_pairing.i@kvm_emulate_hypercall
Variable was created at:
 kvm_emulate_hypercall+0x60/0x21b0 arch/x86/kvm/x86.c:6827
 handle_vmcall+0x41/0x50 arch/x86/kvm/vmx.c:7487

Bytes 28-63 of 64 are uninitialized
Memory access of size 64 starts at ffff8801aac5f3d8
Data copied to user address 0000000020000000
==================================================================

Crashes (36):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/11/07 04:42 https://github.com/google/kmsan.git master 7438a3b20295 8bd6bd63 .config console log report syz C ci-upstream-kmsan-gce
2018/10/28 20:55 https://github.com/google/kmsan.git master 4bb25354f0b0 6f9b225a .config console log report syz ci-upstream-kmsan-gce
2018/10/24 17:50 https://github.com/google/kmsan.git master 4bb25354f0b0 a8292de9 .config console log report syz ci-upstream-kmsan-gce
2018/10/24 11:39 https://github.com/google/kmsan.git master 4bb25354f0b0 a8292de9 .config console log report syz ci-upstream-kmsan-gce
2018/10/22 11:56 https://github.com/google/kmsan.git master 4bb25354f0b0 ecb386fe .config console log report syz ci-upstream-kmsan-gce
2018/10/21 07:23 https://github.com/google/kmsan.git master 4bb25354f0b0 ecb386fe .config console log report syz ci-upstream-kmsan-gce
2018/10/21 06:42 https://github.com/google/kmsan.git master 4bb25354f0b0 ecb386fe .config console log report syz ci-upstream-kmsan-gce
2018/12/04 21:07 https://github.com/google/kmsan.git master 00f99f811392 6ad0ae61 .config console log report ci-upstream-kmsan-gce
2018/12/03 19:25 https://github.com/google/kmsan.git master 1d3abf0f2b29 819002b0 .config console log report ci-upstream-kmsan-gce
2018/12/03 16:25 https://github.com/google/kmsan.git master 1d3abf0f2b29 819002b0 .config console log report ci-upstream-kmsan-gce
2018/12/03 16:00 https://github.com/google/kmsan.git master 1d3abf0f2b29 819002b0 .config console log report ci-upstream-kmsan-gce
2018/11/30 18:44 https://github.com/google/kmsan.git master 3a68698849b6 ade12e91 .config console log report ci-upstream-kmsan-gce
2018/11/30 13:05 https://github.com/google/kmsan.git master c1c8fce47960 66071e27 .config console log report ci-upstream-kmsan-gce
2018/11/30 13:00 https://github.com/google/kmsan.git master c1c8fce47960 66071e27 .config console log report ci-upstream-kmsan-gce
2018/11/28 04:51 https://github.com/google/kmsan.git master fffec98ae2a6 4b6d14f2 .config console log report ci-upstream-kmsan-gce
2018/11/25 10:42 https://github.com/google/kmsan.git master fffec98ae2a6 3d3ec907 .config console log report ci-upstream-kmsan-gce
2018/11/23 12:48 https://github.com/google/kmsan.git master f97a6c2987cc 2b0dc848 .config console log report ci-upstream-kmsan-gce
2018/11/23 08:07 https://github.com/google/kmsan.git master 50031178f793 2b0dc848 .config console log report ci-upstream-kmsan-gce
2018/11/23 03:39 https://github.com/google/kmsan.git master 50031178f793 87815d9d .config console log report ci-upstream-kmsan-gce
2018/11/23 02:50 https://github.com/google/kmsan.git master 50031178f793 87815d9d .config console log report ci-upstream-kmsan-gce
2018/11/19 07:53 https://github.com/google/kmsan.git master cddc52641fd2 adf636a8 .config console log report ci-upstream-kmsan-gce
2018/11/16 16:43 https://github.com/google/kmsan.git master cddc52641fd2 f5e275d1 .config console log report ci-upstream-kmsan-gce
2018/11/15 21:29 https://github.com/google/kmsan.git master 7fd538851cec 3a41052e .config console log report ci-upstream-kmsan-gce
2018/11/11 02:11 https://github.com/google/kmsan.git master 746f11553795 f3c4e618 .config console log report ci-upstream-kmsan-gce
2018/11/08 14:49 https://github.com/google/kmsan.git master 7438a3b20295 e85d2a61 .config console log report ci-upstream-kmsan-gce
2018/11/06 19:43 https://github.com/google/kmsan.git master 7438a3b20295 8bd6bd63 .config console log report ci-upstream-kmsan-gce
2018/11/06 10:32 https://github.com/google/kmsan.git master 88b95ef4c780 8bd6bd63 .config console log report ci-upstream-kmsan-gce
2018/10/28 19:47 https://github.com/google/kmsan.git master 4bb25354f0b0 6f9b225a .config console log report ci-upstream-kmsan-gce
2018/10/28 19:41 https://github.com/google/kmsan.git master 4bb25354f0b0 6f9b225a .config console log report ci-upstream-kmsan-gce
2018/10/26 03:35 https://github.com/google/kmsan.git master 4bb25354f0b0 a8292de9 .config console log report ci-upstream-kmsan-gce
2018/10/24 06:16 https://github.com/google/kmsan.git master 4bb25354f0b0 a8292de9 .config console log report ci-upstream-kmsan-gce
2018/10/24 06:13 https://github.com/google/kmsan.git master 4bb25354f0b0 a8292de9 .config console log report ci-upstream-kmsan-gce
2018/10/22 11:15 https://github.com/google/kmsan.git master 4bb25354f0b0 ecb386fe .config console log report ci-upstream-kmsan-gce
2018/10/21 06:01 https://github.com/google/kmsan.git master 4bb25354f0b0 ecb386fe .config console log report ci-upstream-kmsan-gce
2018/10/21 05:56 https://github.com/google/kmsan.git master 4bb25354f0b0 ecb386fe .config console log report ci-upstream-kmsan-gce
2018/10/15 22:37 https://github.com/google/kmsan.git master 22ec98c3e38f 8cd30605 .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.