[PW_SID:1057146] RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()#1492
Open
linux-riscv-bot wants to merge 1 commit intoworkflow__riscv__fixesfrom
Open
[PW_SID:1057146] RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()#1492linux-riscv-bot wants to merge 1 commit intoworkflow__riscv__fixesfrom
linux-riscv-bot wants to merge 1 commit intoworkflow__riscv__fixesfrom
Conversation
Fuzzer reports a KASAN use-after-free bug triggered by a race
between KVM_HAS_DEVICE_ATTR and KVM_SET_DEVICE_ATTR ioctls on the AIA
device. The root cause is that aia_has_attr() invokes
kvm_riscv_aia_aplic_has_attr() without holding dev->kvm->lock, while
a concurrent aia_set_attr() may call aia_init() under that lock. When
aia_init() fails after kvm_riscv_aia_aplic_init() has succeeded, it
calls kvm_riscv_aia_aplic_cleanup() in its fail_cleanup_imsics path,
which frees both aplic_state and aplic_state->irqs. The concurrent
has_attr path can then dereference the freed aplic->irqs in
aplic_read_pending():
irqd = &aplic->irqs[irq]; /* UAF here */
KASAN report:
BUG: KASAN: slab-use-after-free in aplic_read_pending
arch/riscv/kvm/aia_aplic.c:119 [inline]
BUG: KASAN: slab-use-after-free in aplic_read_pending_word
arch/riscv/kvm/aia_aplic.c:351 [inline]
BUG: KASAN: slab-use-after-free in aplic_mmio_read_offset
arch/riscv/kvm/aia_aplic.c:406
Read of size 8 at addr ff600000ba965d58 by task 9498
Call Trace:
aplic_read_pending arch/riscv/kvm/aia_aplic.c:119 [inline]
aplic_read_pending_word arch/riscv/kvm/aia_aplic.c:351 [inline]
aplic_mmio_read_offset arch/riscv/kvm/aia_aplic.c:406
kvm_riscv_aia_aplic_has_attr arch/riscv/kvm/aia_aplic.c:566
aia_has_attr arch/riscv/kvm/aia_device.c:469
allocated by task 9473:
kvm_riscv_aia_aplic_init arch/riscv/kvm/aia_aplic.c:583
aia_init arch/riscv/kvm/aia_device.c:248 [inline]
aia_set_attr arch/riscv/kvm/aia_device.c:334
freed by task 9473:
kvm_riscv_aia_aplic_cleanup arch/riscv/kvm/aia_aplic.c:644
aia_init arch/riscv/kvm/aia_device.c:292 [inline]
aia_set_attr arch/riscv/kvm/aia_device.c:334
The patch replaces the actual MMIO read in kvm_riscv_aia_aplic_has_attr()
with a new aplic_mmio_has_offset() that only validates whether the given
offset falls within a known APLIC region, without touching any
dynamically allocated state. This is consistent with the KVM API
documentation for KVM_HAS_DEVICE_ATTR:
"Tests whether a device supports a particular attribute. A successful
return indicates the attribute is implemented. It does not necessarily
indicate that the attribute can be read or written in the device's
current state."
The upper bounds of each region are taken directly from the
RISC-V AIA specification, so the check is independent of the runtime
values of nr_irqs and nr_words.
This patch both fixes the use-after-free and makes the has_attr
implementation semantically correct.
Fixes: 289a007 ("RISC-V: KVM: Expose APLIC registers as attributes of AIA irqchip")
Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com>
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
Author
|
Patch 1: "RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR for series 1057146 applied to workflow__riscv__fixes
Name: RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr()
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1057146
Version: 1