KASAN: out-of-bounds Read in kvm_arch_hardware

KASAN: out-of-bounds Read in kvm_arch_hardware_setup
Status: closed as dup on 2020/06/30 06:12
Reported-by: syzbot+e0240f9c36530bda7130@syzkaller.appspotmail.com
First crash: 358d, last: 358d

Duplicate of (1):
Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported
general protection fault in syscall_return_slowpath	syz	inconclusive	done	1	379d	465d

Sample crash report:

==================================================================
BUG: KASAN: out-of-bounds in kvm_cpu_cap_get arch/x86/kvm/cpuid.h:292 [inline]
BUG: KASAN: out-of-bounds in kvm_cpu_cap_has arch/x86/kvm/cpuid.h:297 [inline]
BUG: KASAN: out-of-bounds in kvm_init_msr_list arch/x86/kvm/x86.c:5362 [inline]
BUG: KASAN: out-of-bounds in kvm_arch_hardware_setup+0xb05/0xf40 arch/x86/kvm/x86.c:9802
Read of size 4 at addr ffffffff896c3134 by task syz-executor614/6786

CPU: 1 PID: 6786 Comm: syz-executor614 Not tainted 5.7.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1e9/0x30e lib/dump_stack.c:118
 print_address_description+0x66/0x5a0 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report+0x132/0x1d0 mm/kasan/report.c:530
 kvm_cpu_cap_get arch/x86/kvm/cpuid.h:292 [inline]
 kvm_cpu_cap_has arch/x86/kvm/cpuid.h:297 [inline]
 kvm_init_msr_list arch/x86/kvm/x86.c:5362 [inline]
 kvm_arch_hardware_setup+0xb05/0xf40 arch/x86/kvm/x86.c:9802
 </IRQ>

The buggy address belongs to the variable:
 kvm_cpu_caps+0x24/0x50

Memory state around the buggy address:
 ffffffff896c3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff896c3080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff896c3100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                        ^
 ffffffff896c3180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff896c3200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-kasan-gce-smack-root	2020/06/23 19:56	upstream	7ae77150	54566aff	.config	log	report	syz	C