[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH for-4.18] x86/time: Fix UBSAN failure in __update_vcpu_system_time()


  • To: Xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxxx>
  • From: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
  • Date: Wed, 1 Nov 2023 20:37:37 +0000
  • Authentication-results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none
  • Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Jan Beulich <JBeulich@xxxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>, Wei Liu <wl@xxxxxxx>, Henry Wang <Henry.Wang@xxxxxxx>
  • Delivery-date: Wed, 01 Nov 2023 20:38:09 +0000
  • Ironport-data: A9a23:qPZUIazbDUWTvaCivER6t+cjxirEfRIJ4+MujC+fZmUNrF6WrkVVm jYfXGuHOK6OZGbzeNF3YdyxpBtS7J+GndJrHAs9/iAxQypGp/SeCIXCJC8cHc8wwu7rFxs7s ppEOrEsCOhuExcwcz/0auCJQUFUjPzOHvykTrecZkidfCc8IA85kxVvhuUltYBhhNm9Emult Mj75sbSIzdJ4RYtWo4vw/zF8EgHUMja4mtC5QVnPakT5zcyqlFOZH4hDfDpR5fHatE88t6SH 47r0Ly/92XFyBYhYvvNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ai87XAME0e0ZP4whlqvgqo Dl7WT5cfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQq2pYjqhljJBheAGEWxgp4KXpy7 fkjOhAIUlO4of2b/YuFbMpAu+12eaEHPKtH0p1h5TTQDPJgSpHfWaTao9Rf2V/chOgXQ6yYP ZBAL2MyPVKfO3WjOX9OYH46tM6uimPybHtzr1WNqLBsy2PS0BZwwP7mN9+9ltmiHJ8KxxnA9 jOWl4j/KioKD82N2QSByGqTiu3Ath3LQ7MeK5Tto5aGh3XMnzdOWXX6T2CTsfS/z0KzRd9bA 0gV4TY167g/8lSxSdvwVAH+p2SL1jY+cddNF+wx6CmW17HZpQ2eAwAsUTppeNEg8sgsSlQC9 lKPhcKvOjVpv5WcU3fb/bCRxQ5eIgBMczVEP3VdC1JYsp+8+Onfky4jUP54LLawtc/VHA2z+ BaVgRUHuZMwofMigvDTEU/8v968mnTYZldrt1WHBzr9tFMRiJ2NPdLytQaBhRpUBMPJFgPf4 SJsd922tbhWVfmweDqxrPLh9V1Dz92CKjTYyWV3BZgn+C/FF5WLJtsIv2gWyKuEKK85ld7Vj Kz741g5CGd7ZifCUEOOS9vZ5z4W5abhD8/5cfvfc8BDZJN8HCfeonA+NRDLgT6zwBF8+U3aB Xt8WZ/yZUv29Iw+kWHoLwvj+eRDKt8CKZP7GsmgkkXPPUu2b3+JU7YVWGazghQCxPrc+m39q o8PX/ZmPj0DCIUSlAGLq99MRb3LRFBnba3LRzt/LL7dfVE7RDB9V5c8A9oJIuRYokicrc+Ql lnVZ6OS4AOXaaHvQelSVk1eVQ==
  • Ironport-hdrordr: A9a23:4NtU1K7WrjUk6CwdzAPXwMXXdLJyesId70hD6qkRc20wTiT7// rFoB1/73LJYVkqNE3I9ervBEDiewK4yXcW2/hzAV7KZmCP01dASrsC0WKI+UyDJ8SRzI5g/J YlV5JeYeeeMWRH
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>

As reported:

  (XEN) 
================================================================================
  (XEN) UBSAN: Undefined behaviour in arch/x86/time.c:1542:32
  (XEN) member access within null pointer of type 'union vcpu_info_t'
  (XEN) ----[ Xen-4.19-unstable  x86_64  debug=y ubsan=y  Not tainted ]----
  ...
  (XEN) Xen call trace:
  (XEN)    [<ffff82d040345036>] R common/ubsan/ubsan.c#ubsan_epilogue+0xa/0xd2
  (XEN)    [<ffff82d0403456e8>] F __ubsan_handle_type_mismatch+0x133/0x49b
  (XEN)    [<ffff82d040345b4a>] F __ubsan_handle_type_mismatch_v1+0xfa/0xfc
  (XEN)    [<ffff82d040623356>] F 
arch/x86/time.c#__update_vcpu_system_time+0x212/0x30f
  (XEN)    [<ffff82d040623461>] F update_vcpu_system_time+0xe/0x10
  (XEN)    [<ffff82d04062389d>] F 
arch/x86/time.c#local_time_calibration+0x1f7/0x523
  (XEN)    [<ffff82d0402a64b5>] F common/softirq.c#__do_softirq+0x1f4/0x31a
  (XEN)    [<ffff82d0402a67ad>] F do_softirq+0x13/0x15
  (XEN)    [<ffff82d0405a95dc>] F arch/x86/domain.c#idle_loop+0x2e0/0x367
  (XEN)
  (XEN) 
================================================================================

It is not valid to derive a pointer from vcpu_info() prior to checking that
the underlying map pointer is good.

Reorder actions so the NULL pointer check is first.

Fixes: 20279afd7323 ("x86: split populating of struct vcpu_time_info into a 
separate function")
Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Roger Pau Monné <roger.pau@xxxxxxxxxx>
CC: Wei Liu <wl@xxxxxxx>
CC: Henry Wang <Henry.Wang@xxxxxxx>

4.18 blocker, or we'll need to issue an XSA/CVE.
---
 xen/arch/x86/time.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/time.c b/xen/arch/x86/time.c
index d0b0986509b2..6d33edd0addc 100644
--- a/xen/arch/x86/time.c
+++ b/xen/arch/x86/time.c
@@ -1539,12 +1539,14 @@ static void collect_time_info(const struct vcpu *v,
 
 static void __update_vcpu_system_time(struct vcpu *v, int force)
 {
-    struct vcpu_time_info *u = &vcpu_info(v, time), _u;
+    struct vcpu_time_info *u, _u;
     const struct domain *d = v->domain;
 
     if ( !v->vcpu_info_area.map )
         return;
 
+    u = &vcpu_info(v, time);
+
     collect_time_info(v, &_u);
 
     /* Don't bother unless timestamp record has changed or we are forced. */

base-commit: 7befef87cc9b1bb8ca15d866ce1ecd9165ccb58c
-- 
2.30.2




 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.