kvm: GPF in kvm_ioapic_set_irq

[Dmitry Vyukov]

Hello,

The following program triggers GPF in kvm_ioapic_set_irq:
https://gist.githubusercontent.com/dvyukov/9070377a9fdd685d4496972363b35ec5/raw/bfa9fc85736b6d4993138b945ddfa1b7f3432afc/gistfile1.txt


general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 3 PID: 11923 Comm: kworker/3:2 Not tainted 4.9.0-rc5+ #27
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: events irqfd_inject
task: ffff88006a06c7c0 task.stack: ffff880068638000
RIP: 0010:[<ffffffff81567e25>] [<ffffffff81567e25>]
__lock_acquire+0xb35/0x3380 kernel/locking/lockdep.c:3221
RSP: 0000:ffff88006863ea20 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000039 RSI: 0000000000000000 RDI: 1ffff1000d0c7d9e
RBP: ffff88006863ef58 R08: 0000000000000001 R09: 0000000000000000
R10: 00000000000001c8 R11: 0000000000000000 R12: ffff88006a06c7c0
R13: 0000000000000001 R14: ffffffff8baab1a0 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff88006d100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004abdd0 CR3: 000000003e2f2000 CR4: 00000000000026e0
Stack:
ffffffff894d0098 1ffff1000d0c7d56 ffff88006863ecd0 dffffc0000000000
ffff88006a06c7c0 0000000000000000 ffff88006863ecf8 0000000000000082
0000000000000000 ffffffff815dd7c1 ffffffff00000000 ffffffff00000000
Call Trace:
[<ffffffff8156b542>] lock_acquire+0x2a2/0x790 kernel/locking/lockdep.c:3746
[< inline >] __raw_spin_lock include/linux/spinlock_api_smp.h:144
[<ffffffff881422b8>] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151
[< inline >] spin_lock include/linux/spinlock.h:302
[<ffffffff8118214c>] kvm_ioapic_set_irq+0x4c/0x100 arch/x86/kvm/ioapic.c:379
[<ffffffff811838ff>] kvm_set_ioapic_irq+0x8f/0xc0 arch/x86/kvm/irq_comm.c:52
[<ffffffff81090729>] kvm_set_irq+0x239/0x640
arch/x86/kvm/../../../virt/kvm/irqchip.c:101
[<ffffffff810898e4>] irqfd_inject+0xb4/0x150
arch/x86/kvm/../../../virt/kvm/eventfd.c:60
[<ffffffff81473050>] process_one_work+0xb40/0x1ba0 kernel/workqueue.c:2096
[<ffffffff814742c4>] worker_thread+0x214/0x18a0 kernel/workqueue.c:2230
[<ffffffff81489ee8>] kthread+0x328/0x3e0 kernel/kthread.c:209
[<ffffffff88143b1a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
Code: e9 03 f3 48 ab 48 81 c4 10 05 00 00 44 89 e8 5b 41 5c 41 5d 41
5e 41 5f 5d c3 4c 89 d2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
3c 02 00 0f 85 00 26 00 00 49 81 3a c0 74 e1 8a 41 bf 00 00
RIP [<ffffffff81567e25>] __lock_acquire+0xb35/0x3380
kernel/locking/lockdep.c:3221
RSP <ffff88006863ea20>
---[ end trace 9e23ceae3896b509 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1

On commit a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (Nov 13).