[v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d86dfc4d95cd Linux 5.15.106
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13b385ddc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=dca379fe384dda80
dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2c159eb4fcae/disk-d86dfc4d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5f50187f87c7/vmlinux-d86dfc4d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f787f3f09c09/bzImage-d86dfc4d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+412c9a...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 30262 at arch/x86/kvm/x86.c:10310 kvm_arch_vcpu_ioctl_run+0x1d63/0x1f80
Modules linked in:
CPU: 0 PID: 30262 Comm: syz-executor.1 Not tainted 5.15.106-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
RIP: 0010:kvm_arch_vcpu_ioctl_run+0x1d63/0x1f80 arch/x86/kvm/x86.c:10310
Code: df e8 51 76 b9 00 e9 e5 fa ff ff 89 d9 80 e1 07 38 c1 0f 8c 26 fb ff ff 48 89 df e8 37 76 b9 00 e9 19 fb ff ff e8 7d 2e 70 00 <0f> 0b e9 e0 fb ff ff 89 d9 80 e1 07 38 c1 0f 8c 63 fb ff ff 48 89
RSP: 0018:ffffc900030f7c60 EFLAGS: 00010283
RAX: ffffffff810f8c33 RBX: 0000000000000000 RCX: 0000000000040000
RDX: ffffc90006e14000 RSI: 0000000000000401 RDI: 0000000000000402
RBP: dffffc0000000000 R08: ffffffff8116a882 R09: fffffbfff1bc635e
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88801c260000
R13: ffff888034968000 R14: ffff8880349680f0 R15: ffff888077015000
FS: 00007f3d9dec7700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555626e708 CR3: 0000000078e14000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kvm_vcpu_ioctl+0x7f0/0xcf0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3863
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f3d9f976169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3d9dec7168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f3d9fa96050 RCX: 00007f3d9f976169
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00007f3d9f9d1ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff39d449bf R14: 00007f3d9dec7300 R15: 0000000000022000
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15f12318280000
kernel config: https://syzkaller.appspot.com/x/.config?x=ba8d5c9d6c5289f

dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e13c84280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=149d9470280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fc04f54c047f/disk-8a7f2a5c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6b4ba4cb1191/vmlinux-8a7f2a5c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d927dc3f9670/bzImage-8a7f2a5c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+412c9a...@syzkaller.appspotmail.com

------------[ cut here ]------------

WARNING: CPU: 0 PID: 3502 at arch/x86/kvm/x86.c:10310 kvm_arch_vcpu_ioctl_run+0x1d63/0x1f80
Modules linked in:
CPU: 1 PID: 3502 Comm: syz-executor306 Not tainted 5.15.110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023

RIP: 0010:kvm_arch_vcpu_ioctl_run+0x1d63/0x1f80 arch/x86/kvm/x86.c:10310

Code: df e8 71 ac b9 00 e9 e5 fa ff ff 89 d9 80 e1 07 38 c1 0f 8c 26 fb ff ff 48 89 df e8 57 ac b9 00 e9 19 fb ff ff e8 4d 52 70 00 <0f> 0b e9 e0 fb ff ff 89 d9 80 e1 07 38 c1 0f 8c 63 fb ff ff 48 89
RSP: 0018:ffffc90002bcfc60 EFLAGS: 00010293
RAX: ffffffff810f8c33 RBX: 0000000000000000 RCX: ffff888012bc1d00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff8116a882 R09: fffffbfff1bc744e
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888012bc1d00
R13: ffff888077580000 R14: ffff8880775800f0 R15: ffff88801e2a9000
FS: 000055555696f300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fafc4b53130 CR3: 000000007c8ce000 CR4: 00000000003526e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
kvm_vcpu_ioctl+0x7f0/0xcf0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3863
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb

RIP: 0033:0x7fafc4ae1ed9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd3bb98a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000000cdf3 RCX: 00007fafc4ae1ed9

RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005

RBP: 0000000000000000 R08: 00007ffd3bb98be8 R09: 00007ffd3bb98be8
R10: 00007ffd3bb98be8 R11: 0000000000000246 R12: 00007ffd3bb98a5c
R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Muhammad Usama Anjum]

On 5/5/23 1:28 PM, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110

This same warning has also been found on 6.1.21.

> git tree: linux-5.15.y
> console output: https://syzkaller.appspot.com/x/log.txt?x=15f12318280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ba8d5c9d6c5289f
> dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e13c84280000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=149d9470280000

I've tried all the C and syz reproducers. I've also tried syz-crash which
launched multiple instances of VMs and ran syz reproducer. But the issue
didn't get reproduced.

I don't have kvm skills. Can someone have a look at the the warning
(probably by static analysis)?

--
BR,
Muhammad Usama Anjum

[Sean Christopherson]

"Fixed" by https://lore.kernel.org/all/20230808232057....@google.com,
in quotes because sadly the fix was to simply delete the sanity check :-(

[Muhammad Usama Anjum]

Thank you so much Sean. Thank you so much Sean. Syzbot has been finding the issue in LTS kernels. I'm not sure if we should backport a patch which is just removing a false warning.

#syz fix: KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU

[syzbot]

This bug is marked as fixed by commit:

KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU

But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:

#syz fix: exact-commit-title

Until then the bug is still considered open and new crashes with
the same signature are ignored.

Kernel: Linux 5.15
Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e

---
[1] I expect the commit to be present in:

1. linux-5.15.y branch of
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

[Muhammad Usama Anjum]

On 11/26/23 8:24 PM, syzbot wrote:
> This bug is marked as fixed by commit:
> KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU
>
> But I can't find it in the tested trees[1] for more than 90 days.

The commit is already in 6.7-rc3:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7b0151caf73a656b75b550e361648430233455a0

> Is it a correct commit? Please update it by replying:
>
> #syz fix: exact-commit-title

The title is already correct.

>
> Until then the bug is still considered open and new crashes with
> the same signature are ignored.
>
> Kernel: Linux 5.15
> Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
>
> ---
> [1] I expect the commit to be present in:
>
> 1. linux-5.15.y branch of
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

[syzbot]

This bug is marked as fixed by commit:
KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU

But I can't find it in the tested trees[1] for more than 90 days.

Is it a correct commit? Please update it by replying:

#syz fix: exact-commit-title

[syzbot]

[syzbot]

[Muhammad Usama Anjum]

On 1/9/24 11:18 PM, syzbot wrote:
> This bug is marked as fixed by commit:
> KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU
>
> But I can't find it in the tested trees[1] for more than 90 days.

Just found out that the fix hasn't been back ported to this kernel. The fix
could be backported and sent to be included in this stable kernel.

#syz unfix

> Is it a correct commit? Please update it by replying:
>
> #syz fix: exact-commit-title
>
> Until then the bug is still considered open and new crashes with
> the same signature are ignored.
>
> Kernel: Linux 5.15
> Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
>
> ---
> [1] I expect the commit to be present in:
>
> 1. linux-5.15.y branch of
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git