kvm: BUG in pte_list_remove
159 views
Skip to first unread message
Dmitry Vyukov
Nov 12, 2016, 3:35:09 PM11/12/16
to Paolo Bonzini, rkr...@redhat.com, Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x...@kernel.org, KVM list, LKML, Steve Rutherford, syzkaller
Hello,
The following program triggers BUG in pte_list_remove:
https://gist.githubusercontent.com/dvyukov/c763720296f6f4e51934c58ade173a71/raw/2f78e3e634dcd8c3d39d2fbbdcd2afb02bc736f5/gistfile1.txt
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (nov 11)
kernel BUG at arch/x86/kvm/mmu.c:1016!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 1923 Comm: syz-executor Not tainted 4.9.0-rc4+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88003744c480 task.stack: ffff88003bcc8000
RIP: 0010:[<ffffffff810c6996>] [<ffffffff810c6996>]
pte_list_remove+0x3a6/0x3f0 arch/x86/kvm/mmu.c:1015
RSP: 0018:ffff88003bccf660 EFLAGS: 00010286
RAX: 0000000000000028 RBX: ffff88003c2f5d68 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 0000000000000001 RDI: ffffed0007799ec0
RBP: ffff88003bccf6a0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff84da2600 R11: 0000000000000001 R12: ffff88003763aa08
R13: 0000000000000000 R14: 000000000000000f R15: ffff88003763aa30
FS: 00007f5cac039700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e0000 CR3: 000000003ba9a000 CR4: 00000000000026f0
DR0: 000000000000e3f1 DR1: 0000000000000006 DR2: 0000000000000006
DR3: 0000000000000458 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
ffff88003c2f5d68 0000000000000001 ffff88003dd43078 ffff88003dd43078
ffff88003763aa08 ffff88003d70c000 000000000000000f ffff88003763aa30
ffff88003bccf6e0 ffffffff810d1eb6 ffff88003744c480 0000000037d8cc77
Call Trace:
[< inline >] rmap_remove arch/x86/kvm/mmu.c:1092
[<ffffffff810d1eb6>] drop_spte+0x166/0x260 arch/x86/kvm/mmu.c:1174
[<ffffffff810d267d>] mmu_page_zap_pte+0x19d/0x1e0 arch/x86/kvm/mmu.c:2295
[< inline >] kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2317
[<ffffffff810d9486>] kvm_mmu_prepare_zap_page+0x126/0xd60
arch/x86/kvm/mmu.c:2361
[< inline >] kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:4904
[<ffffffff810eb1d4>] kvm_mmu_invalidate_zap_all_pages+0x2d4/0x490
arch/x86/kvm/mmu.c:4945
[<ffffffff810b8055>] kvm_arch_flush_shadow_all+0x15/0x20
arch/x86/kvm/x86.c:8152
[<ffffffff81059d91>] kvm_mmu_notifier_release+0x71/0xb0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:467
[<ffffffff8164fe61>] __mmu_notifier_release+0x101/0x3e0 mm/mmu_notifier.c:74
[< inline >] mmu_notifier_release include/linux/mmu_notifier.h:235
[<ffffffff815fe1dc>] exit_mmap+0x32c/0x3d0 mm/mmap.c:2918
[< inline >] __mmput kernel/fork.c:866
[<ffffffff812345c5>] mmput+0x95/0x300 kernel/fork.c:888
[< inline >] exit_mm kernel/exit.c:512
[<ffffffff8124885d>] do_exit+0x71d/0x2bc0 kernel/exit.c:815
[<ffffffff8124efa8>] do_group_exit+0x108/0x330 kernel/exit.c:931
[<ffffffff81271117>] get_signal+0x617/0x1780 kernel/signal.c:2307
[<ffffffff8118294d>] do_signal+0x8d/0x19d0 arch/x86/kernel/signal.c:807
[<ffffffff810039f7>] exit_to_usermode_loop+0xf7/0x150
arch/x86/entry/common.c:156
[< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190
[<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0
arch/x86/entry/common.c:259
[<ffffffff831f0e62>] entry_SYSCALL_64_fastpath+0xc0/0xc2
Code: 71 71 39 00 48 8b 75 d0 48 c7 c7 40 3e 22 83 e8 6a 07 48 00 0f
0b e8 5a 71 39 00 48 8b 75 d0 48 c7 c7 00 3e 22 83 e8 53 07 48 00 <0f>
0b e8 63 48 59 00 e9 c1 fe ff ff e8 f9 48 59 00 e9 4a ff ff
RIP [<ffffffff810c6996>] pte_list_remove+0x3a6/0x3f0 arch/x86/kvm/mmu.c:1015
RSP <ffff88003bccf660>
---[ end trace 1cbf703067869156 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1
The following program triggers BUG in pte_list_remove:
https://gist.githubusercontent.com/dvyukov/c763720296f6f4e51934c58ade173a71/raw/2f78e3e634dcd8c3d39d2fbbdcd2afb02bc736f5/gistfile1.txt
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (nov 11)
kernel BUG at arch/x86/kvm/mmu.c:1016!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 1923 Comm: syz-executor Not tainted 4.9.0-rc4+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88003744c480 task.stack: ffff88003bcc8000
RIP: 0010:[<ffffffff810c6996>] [<ffffffff810c6996>]
pte_list_remove+0x3a6/0x3f0 arch/x86/kvm/mmu.c:1015
RSP: 0018:ffff88003bccf660 EFLAGS: 00010286
RAX: 0000000000000028 RBX: ffff88003c2f5d68 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 0000000000000001 RDI: ffffed0007799ec0
RBP: ffff88003bccf6a0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff84da2600 R11: 0000000000000001 R12: ffff88003763aa08
R13: 0000000000000000 R14: 000000000000000f R15: ffff88003763aa30
FS: 00007f5cac039700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e0000 CR3: 000000003ba9a000 CR4: 00000000000026f0
DR0: 000000000000e3f1 DR1: 0000000000000006 DR2: 0000000000000006
DR3: 0000000000000458 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
ffff88003c2f5d68 0000000000000001 ffff88003dd43078 ffff88003dd43078
ffff88003763aa08 ffff88003d70c000 000000000000000f ffff88003763aa30
ffff88003bccf6e0 ffffffff810d1eb6 ffff88003744c480 0000000037d8cc77
Call Trace:
[< inline >] rmap_remove arch/x86/kvm/mmu.c:1092
[<ffffffff810d1eb6>] drop_spte+0x166/0x260 arch/x86/kvm/mmu.c:1174
[<ffffffff810d267d>] mmu_page_zap_pte+0x19d/0x1e0 arch/x86/kvm/mmu.c:2295
[< inline >] kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2317
[<ffffffff810d9486>] kvm_mmu_prepare_zap_page+0x126/0xd60
arch/x86/kvm/mmu.c:2361
[< inline >] kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:4904
[<ffffffff810eb1d4>] kvm_mmu_invalidate_zap_all_pages+0x2d4/0x490
arch/x86/kvm/mmu.c:4945
[<ffffffff810b8055>] kvm_arch_flush_shadow_all+0x15/0x20
arch/x86/kvm/x86.c:8152
[<ffffffff81059d91>] kvm_mmu_notifier_release+0x71/0xb0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:467
[<ffffffff8164fe61>] __mmu_notifier_release+0x101/0x3e0 mm/mmu_notifier.c:74
[< inline >] mmu_notifier_release include/linux/mmu_notifier.h:235
[<ffffffff815fe1dc>] exit_mmap+0x32c/0x3d0 mm/mmap.c:2918
[< inline >] __mmput kernel/fork.c:866
[<ffffffff812345c5>] mmput+0x95/0x300 kernel/fork.c:888
[< inline >] exit_mm kernel/exit.c:512
[<ffffffff8124885d>] do_exit+0x71d/0x2bc0 kernel/exit.c:815
[<ffffffff8124efa8>] do_group_exit+0x108/0x330 kernel/exit.c:931
[<ffffffff81271117>] get_signal+0x617/0x1780 kernel/signal.c:2307
[<ffffffff8118294d>] do_signal+0x8d/0x19d0 arch/x86/kernel/signal.c:807
[<ffffffff810039f7>] exit_to_usermode_loop+0xf7/0x150
arch/x86/entry/common.c:156
[< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190
[<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0
arch/x86/entry/common.c:259
[<ffffffff831f0e62>] entry_SYSCALL_64_fastpath+0xc0/0xc2
Code: 71 71 39 00 48 8b 75 d0 48 c7 c7 40 3e 22 83 e8 6a 07 48 00 0f
0b e8 5a 71 39 00 48 8b 75 d0 48 c7 c7 00 3e 22 83 e8 53 07 48 00 <0f>
0b e8 63 48 59 00 e9 c1 fe ff ff e8 f9 48 59 00 e9 4a ff ff
RIP [<ffffffff810c6996>] pte_list_remove+0x3a6/0x3f0 arch/x86/kvm/mmu.c:1015
RSP <ffff88003bccf660>
---[ end trace 1cbf703067869156 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1
Paolo Bonzini
Nov 13, 2016, 11:00:38 AM11/13/16
to Dmitry Vyukov, rkr...@redhat.com, Steve Rutherford, syzkaller
Beautified source code:
#include <fcntl.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/kvm.h>
long r[16];
int main()
{
void *p = valloc(0x4000);
r[2] = open("/dev/kvm", 0);
r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
uint64_t addr = 0xf000;
ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
ioctl(r[6], KVM_RUN, 0);
ioctl(r[6], KVM_RUN, 0);
struct kvm_userspace_memory_region mr = {
.slot = 0,
.flags = KVM_MEM_LOG_DIRTY_PAGES,
.guest_phys_addr = 0xf000,
.memory_size = 0x4000,
.userspace_addr = (uintptr_t) p
};
ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
return 0;
}
#include <fcntl.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/kvm.h>
long r[16];
int main()
{
void *p = valloc(0x4000);
r[2] = open("/dev/kvm", 0);
r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
uint64_t addr = 0xf000;
ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
ioctl(r[6], KVM_RUN, 0);
ioctl(r[6], KVM_RUN, 0);
struct kvm_userspace_memory_region mr = {
.slot = 0,
.flags = KVM_MEM_LOG_DIRTY_PAGES,
.guest_phys_addr = 0xf000,
.memory_size = 0x4000,
.userspace_addr = (uintptr_t) p
};
ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
return 0;
}
Dmitry Vyukov
Nov 14, 2016, 4:04:09 AM11/14/16
to Paolo Bonzini, rkr...@redhat.com, Steve Rutherford, syzkaller, Kostya Serebryany
Paolo,
can you please also commit this test to tools/testing? We are
frustrated by the situation that we reported hundreds of bugs with
reproducers, but exactly 0 kernel regression tests were added.
can you please also commit this test to tools/testing? We are
frustrated by the situation that we reported hundreds of bugs with
reproducers, but exactly 0 kernel regression tests were added.
Paolo Bonzini
Nov 14, 2016, 4:34:55 AM11/14/16
to Dmitry Vyukov, rkr...@redhat.com, Steve Rutherford, syzkaller, Kostya Serebryany
On 14/11/2016 10:03, Dmitry Vyukov wrote:
> Paolo,
> can you please also commit this test to tools/testing? We are
> frustrated by the situation that we reported hundreds of bugs with
> reproducers, but exactly 0 kernel regression tests were added.
look into adding some KVM regression testing to tools/testing this time.
Paolo
Dmitry Vyukov
Nov 14, 2016, 4:44:17 AM11/14/16
to Paolo Bonzini, Radim Krčmář, Steve Rutherford, syzkaller, Kostya Serebryany
On Mon, Nov 14, 2016 at 10:34 AM, Paolo Bonzini <pbon...@redhat.com> wrote:
>
>
> On 14/11/2016 10:03, Dmitry Vyukov wrote:
>> Paolo,
>> can you please also commit this test to tools/testing? We are
>> frustrated by the situation that we reported hundreds of bugs with
>> reproducers, but exactly 0 kernel regression tests were added.
>
> Ok. Last time I only put the reproducers in commit messages. We can
> look into adding some KVM regression testing to tools/testing this time.
Tests in commit messages will be lost.
>
>
> On 14/11/2016 10:03, Dmitry Vyukov wrote:
>> Paolo,
>> can you please also commit this test to tools/testing? We are
>> frustrated by the situation that we reported hundreds of bugs with
>> reproducers, but exactly 0 kernel regression tests were added.
>
> Ok. Last time I only put the reproducers in commit messages. We can
> look into adding some KVM regression testing to tools/testing this time.
Growing a base of kernel regression tests will be great.
Dmitry Vyukov
Mar 23, 2017, 12:42:51 PM3/23/17
to Paolo Bonzini, Radim Krčmář, Steve Rutherford, syzkaller, KVM list, Xiao Guangrong, Haozhong Zhang, James Mattson, Wanpeng Li, P J P, LKML, David Hildenbrand
------------[ cut here ]------------
kernel BUG at arch/x86/kvm/mmu.c:1157!
invalid opcode: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 2966 Comm: a.out Not tainted 4.11.0-rc3+ #365
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006432a5c0 task.stack: ffff880064e48000
RIP: 0010:pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156
RSP: 0018:ffff880064e4eda0 EFLAGS: 00010282
RAX: 0000000000000028 RBX: ffff88006ac72180 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 1ffff1000c9c9d72 RDI: ffffed000c9c9da8
RBP: ffff880064e4ede0 R08: ffffed000da03dae R09: ffffed000da03dae
R10: 0000000000000001 R11: ffffed000da03dad R12: 000000000000000f
R13: 0000000000000000 R14: ffff88006bcd8ec0 R15: ffff88006bcd8ee8
FS: 0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000006870b000 CR4: 00000000001426f0
Call Trace:
rmap_remove arch/x86/kvm/mmu.c:1233 [inline]
drop_spte+0x16c/0x270 arch/x86/kvm/mmu.c:1315
mmu_page_zap_pte+0x223/0x350 arch/x86/kvm/mmu.c:2427
kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2449 [inline]
kvm_mmu_prepare_zap_page+0x1bb/0x1260 arch/x86/kvm/mmu.c:2493
kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:5123 [inline]
kvm_mmu_invalidate_zap_all_pages+0x4a8/0x680 arch/x86/kvm/mmu.c:5164
kvm_arch_flush_shadow_all+0x15/0x20 arch/x86/kvm/x86.c:8370
kvm_mmu_notifier_release+0x71/0xb0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:472
__mmu_notifier_release+0x1e5/0x6b0 mm/mmu_notifier.c:75
mmu_notifier_release include/linux/mmu_notifier.h:235 [inline]
exit_mmap+0x3a3/0x470 mm/mmap.c:2941
__mmput kernel/fork.c:894 [inline]
mmput+0x25e/0x790 kernel/fork.c:916
exit_mm kernel/exit.c:558 [inline]
do_exit+0xa51/0x26d0 kernel/exit.c:866
do_group_exit+0x149/0x400 kernel/exit.c:983
SYSC_exit_group kernel/exit.c:994 [inline]
SyS_exit_group+0x1d/0x20 kernel/exit.c:992
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x433609
RSP: 002b:00007ffdbe967178 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000433609
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7
R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000d7fbb0
R13: 000000000001b411 R14: 0000000000002710 R15: 00000000006c08b8
Code: 99 f9 5d 00 48 8b 75 d0 48 c7 c7 00 4a 42 84 e8 9c 13 72 00 0f
0b e8 82 f9 5d 00 48 8b 75 d0 48 c7 c7 c0 49 42 84 e8 85 13 72 00 <0f>
0b 4c 89 ef e8 78 14 8c 00 e9 01 fe ff ff 0f 1f 00 55 48 89
RIP: pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156 RSP: ffff880064e4eda0
---[ end trace 2cf22c8ade550ee0 ]---
Wanpeng Li
Mar 23, 2017, 10:56:02 PM3/23/17
to Dmitry Vyukov, Paolo Bonzini, Radim Krčmář, Steve Rutherford, syzkaller, KVM list, Xiao Guangrong, Haozhong Zhang, James Mattson, P J P, LKML, David Hildenbrand
Wanpeng Li
Mar 27, 2017, 3:05:44 AM3/27/17
to Dmitry Vyukov, Paolo Bonzini, Radim Krčmář, Steve Rutherford, syzkaller, KVM list, Xiao Guangrong, Haozhong Zhang, James Mattson, P J P, LKML, David Hildenbrand
2017-03-24 0:42 GMT+08:00 Dmitry Vyukov <dvy...@google.com>:
Regards,
Wanpeng Li
Reply all
Reply to author
Forward
0 new messages