diff mbox series

vhost-vdpa: fix NULL pointer deref in _compat_vdpa_reset

Message ID 1698102863-21122-1-git-send-email-si-wei.liu@oracle.com
State New
Headers
Series vhost-vdpa: fix NULL pointer deref in _compat_vdpa_reset |

Commit Message

Si-Wei Liu Oct. 23, 2023, 11:14 p.m. UTC 
  As subject. There's a vhost_vdpa_reset() done earlier before
vhost_dev is initialized via vhost_dev_init(), ending up with
NULL pointer dereference. Fix is to check if vqs is initialized
before checking backend features and resetting the device.

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP
  CPU: 3 PID: 1727 Comm: qemu-system-x86 Not tainted 6.6.0-rc6+ #2
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-
  a4aeb02-prebuilt.qemu.org 04/01/2014
  RIP: 0010:_compat_vdpa_reset+0x47/0xc0 [vhost_vdpa]
  Code: c7 c7 fb 12 56 a0 4c 8d a5 b8 02 00 00 48 89 ea e8 7e b8 c4
  48 89 ee 48 c7 c7 19 13 56 a0 4c 8b ad b0 02 00 00 <48> 8b 00 49
  00 48 8b 80 88 45 00 00 48 c1 e8 08 48
  RSP: 0018:ffff8881063c3c38 EFLAGS: 00010246
  RAX: 0000000000000000 RBX: ffff8881074eb800 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: ffff888103ab4000 RDI: ffffffffa0561319
  RBP: ffff888103ab4000 R08: 00000000ffffdfff R09: 0000000000000001
  R10: 0000000000000003 R11: ffff88887fecbac0 R12: ffff888103ab42b8
  R13: ffff888106dbe850 R14: 0000000000000003 R15: ffff8881074ebc18
  FS:  00007f02fba6ef00(0000) GS:ffff88885f8c0000(0000)
  knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 00000001325e5003 CR4: 0000000000372ea0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   <TASK>
   ? __die+0x1f/0x60
   ? page_fault_oops+0x14c/0x3b0
   ? exc_page_fault+0x74/0x140
   ? asm_exc_page_fault+0x22/0x30
   ? _compat_vdpa_reset+0x47/0xc0 [vhost_vdpa]
   ? _compat_vdpa_reset+0x32/0xc0 [vhost_vdpa]
   vhost_vdpa_open+0x55/0x270 [vhost_vdpa]
   ? sb_init_dio_done_wq+0x50/0x50
   chrdev_open+0xc0/0x210
   ? __unregister_chrdev+0x50/0x50
   do_dentry_open+0x1fc/0x4f0
   path_openat+0xc2d/0xf20
   do_filp_open+0xb4/0x160
   ? kmem_cache_alloc+0x3c/0x490
   do_sys_openat2+0x8d/0xc0
   __x64_sys_openat+0x6a/0xa0
   do_syscall_64+0x3c/0x80
   entry_SYSCALL_64_after_hwframe+0x46/0xb0

Fixes: 10cbf8dfaf93 ("vhost-vdpa: clean iotlb map during reset for older userspace")
Reported-by: Dragos Tatulea <dtatulea@nvidia.com>
Closes: https://lore.kernel.org/all/b4913f84-8b52-4d28-af51-8573dc361f82@oracle.com/
Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
---
 drivers/vhost/vdpa.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

Comments

Dragos Tatulea Oct. 24, 2023, 7:49 a.m. UTC | #1 
On Mon, 2023-10-23 at 16:14 -0700, Si-Wei Liu wrote:
> As subject. There's a vhost_vdpa_reset() done earlier before
> vhost_dev is initialized via vhost_dev_init(), ending up with
> NULL pointer dereference. Fix is to check if vqs is initialized
> before checking backend features and resetting the device.
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   #PF: supervisor read access in kernel mode
>   #PF: error_code(0x0000) - not-present page
>   PGD 0 P4D 0
>   Oops: 0000 [#1] SMP
>   CPU: 3 PID: 1727 Comm: qemu-system-x86 Not tainted 6.6.0-rc6+ #2
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-
>   a4aeb02-prebuilt.qemu.org 04/01/2014
>   RIP: 0010:_compat_vdpa_reset+0x47/0xc0 [vhost_vdpa]
>   Code: c7 c7 fb 12 56 a0 4c 8d a5 b8 02 00 00 48 89 ea e8 7e b8 c4
>   48 89 ee 48 c7 c7 19 13 56 a0 4c 8b ad b0 02 00 00 <48> 8b 00 49
>   00 48 8b 80 88 45 00 00 48 c1 e8 08 48
>   RSP: 0018:ffff8881063c3c38 EFLAGS: 00010246
>   RAX: 0000000000000000 RBX: ffff8881074eb800 RCX: 0000000000000000
>   RDX: 0000000000000000 RSI: ffff888103ab4000 RDI: ffffffffa0561319
>   RBP: ffff888103ab4000 R08: 00000000ffffdfff R09: 0000000000000001
>   R10: 0000000000000003 R11: ffff88887fecbac0 R12: ffff888103ab42b8
>   R13: ffff888106dbe850 R14: 0000000000000003 R15: ffff8881074ebc18
>   FS:  00007f02fba6ef00(0000) GS:ffff88885f8c0000(0000)
>   knlGS:0000000000000000
>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>   CR2: 0000000000000000 CR3: 00000001325e5003 CR4: 0000000000372ea0
>   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>   Call Trace:
>    <TASK>
>    ? __die+0x1f/0x60
>    ? page_fault_oops+0x14c/0x3b0
>    ? exc_page_fault+0x74/0x140
>    ? asm_exc_page_fault+0x22/0x30
>    ? _compat_vdpa_reset+0x47/0xc0 [vhost_vdpa]
>    ? _compat_vdpa_reset+0x32/0xc0 [vhost_vdpa]
>    vhost_vdpa_open+0x55/0x270 [vhost_vdpa]
>    ? sb_init_dio_done_wq+0x50/0x50
>    chrdev_open+0xc0/0x210
>    ? __unregister_chrdev+0x50/0x50
>    do_dentry_open+0x1fc/0x4f0
>    path_openat+0xc2d/0xf20
>    do_filp_open+0xb4/0x160
>    ? kmem_cache_alloc+0x3c/0x490
>    do_sys_openat2+0x8d/0xc0
>    __x64_sys_openat+0x6a/0xa0
>    do_syscall_64+0x3c/0x80
>    entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> Fixes: 10cbf8dfaf93 ("vhost-vdpa: clean iotlb map during reset for older
> userspace")
> Reported-by: Dragos Tatulea <dtatulea@nvidia.com>

This works, thanks for the quick response.

Tested-by: Dragos Tatulea <dtatulea@nvidia.com>

> Closes:
> https://lore.kernel.org/all/b4913f84-8b52-4d28-af51-8573dc361f82@oracle.com/
> Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
> ---
>  drivers/vhost/vdpa.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index 9ce40003793b..9a2343c45df0 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -232,9 +232,11 @@ static int _compat_vdpa_reset(struct vhost_vdpa *v)
>         struct vdpa_device *vdpa = v->vdpa;
>         u32 flags = 0;
>  
> -       flags |= !vhost_backend_has_feature(v->vdev.vqs[0],
> -                                           VHOST_BACKEND_F_IOTLB_PERSIST) ?
> -                VDPA_RESET_F_CLEAN_MAP : 0;
> +       if (v->vdev.vqs) {
> +               flags |= !vhost_backend_has_feature(v->vdev.vqs[0],
> +                                                  
> VHOST_BACKEND_F_IOTLB_PERSIST) ?
> +                        VDPA_RESET_F_CLEAN_MAP : 0;
> +       }
>  
>         return vdpa_reset(vdpa, flags);
>  }
diff mbox series

Patch

diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index 9ce40003793b..9a2343c45df0 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -232,9 +232,11 @@  static int _compat_vdpa_reset(struct vhost_vdpa *v)
 	struct vdpa_device *vdpa = v->vdpa;
 	u32 flags = 0;
 
-	flags |= !vhost_backend_has_feature(v->vdev.vqs[0],
-					    VHOST_BACKEND_F_IOTLB_PERSIST) ?
-		 VDPA_RESET_F_CLEAN_MAP : 0;
+	if (v->vdev.vqs) {
+		flags |= !vhost_backend_has_feature(v->vdev.vqs[0],
+						    VHOST_BACKEND_F_IOTLB_PERSIST) ?
+			 VDPA_RESET_F_CLEAN_MAP : 0;
+	}
 
 	return vdpa_reset(vdpa, flags);
 }