kvm: WARNING in kvm_arch_vcpu_ioctl_run

kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Dmitry Vyukov]

Hello,

The following program triggers WARNING in kvm_arch_vcpu_ioctl_run in
run in parallel loop:
https://gist.githubusercontent.com/dvyukov/08091eee6f38548ff9e6905c5e0eaaee/raw/8cae95f2e88eeb98c4ddc06d227670c1e248222f/gistfile1.txt

On commit e234832afb623fe5c7d1d5703d6619494d8d703f (Nov 13)

WARNING: CPU: 3 PID: 11141 at arch/x86/kvm/x86.c:6984
kvm_arch_vcpu_ioctl_run+0x1f0/0x4f50
CPU: 3 PID: 11141 Comm: syz-executor Not tainted 4.9.0-rc5+ #24
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff880039cef698 ffffffff834c3959 ffffffff00000003 1ffff1000739de66
 ffffed000739de5e 0000000041b58ab3 ffffffff89576450 ffffffff834c366b
 0000000041b58ab3 ffffffff894d2830 ffffffff81590020 ffffffff810d90f0
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff834c3959>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51
 [<ffffffff81849908>] panic+0x200/0x425 kernel/panic.c:179
 [<ffffffff813fd919>] __warn+0x1c9/0x1e0 kernel/panic.c:542
 [<ffffffff813fdb81>] warn_slowpath_null+0x31/0x40 kernel/panic.c:585
 [<ffffffff810ee930>] kvm_arch_vcpu_ioctl_run+0x1f0/0x4f50
arch/x86/kvm/x86.c:6984
 [<ffffffff8107b328>] kvm_vcpu_ioctl+0x678/0x11c0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff81abdb44>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679
 [<     inline     >] SYSC_ioctl fs/ioctl.c:694
 [<ffffffff81abf044>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685
 [<ffffffff88144885>] entry_SYSCALL_64_fastpath+0x23/0xc6

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Paolo Bonzini]

On 14/11/2016 15:00, Dmitry Vyukov wrote:
> Hello,
> 
> The following program triggers WARNING in kvm_arch_vcpu_ioctl_run in
> run in parallel loop:
> https://gist.githubusercontent.com/dvyukov/08091eee6f38548ff9e6905c5e0eaaee/raw/8cae95f2e88eeb98c4ddc06d227670c1e248222f/gistfile1.txt
> 
> On commit e234832afb623fe5c7d1d5703d6619494d8d703f (Nov 13)
> 
> WARNING: CPU: 3 PID: 11141 at arch/x86/kvm/x86.c:6984
> kvm_arch_vcpu_ioctl_run+0x1f0/0x4f50
> CPU: 3 PID: 11141 Comm: syz-executor Not tainted 4.9.0-rc5+ #24
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>  ffff880039cef698 ffffffff834c3959 ffffffff00000003 1ffff1000739de66
>  ffffed000739de5e 0000000041b58ab3 ffffffff89576450 ffffffff834c366b
>  0000000041b58ab3 ffffffff894d2830 ffffffff81590020 ffffffff810d90f0
> Call Trace:
>  [<     inline     >] __dump_stack lib/dump_stack.c:15
>  [<ffffffff834c3959>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51
>  [<ffffffff81849908>] panic+0x200/0x425 kernel/panic.c:179
>  [<ffffffff813fd919>] __warn+0x1c9/0x1e0 kernel/panic.c:542
>  [<ffffffff813fdb81>] warn_slowpath_null+0x31/0x40 kernel/panic.c:585
>  [<ffffffff810ee930>] kvm_arch_vcpu_ioctl_run+0x1f0/0x4f50
> arch/x86/kvm/x86.c:6984
>  [<ffffffff8107b328>] kvm_vcpu_ioctl+0x678/0x11c0
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
>  [<     inline     >] vfs_ioctl fs/ioctl.c:43
>  [<ffffffff81abdb44>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679
>  [<     inline     >] SYSC_ioctl fs/ioctl.c:694
>  [<ffffffff81abf044>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685
>  [<ffffffff88144885>] entry_SYSCALL_64_fastpath+0x23/0xc6

What I got for now is this dmesg splat:

[31705.171034] *** Guest State ***
[31705.171039] CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7
[31705.171040] CR4: actual=0x0000000000002050, shadow=0x0000000000000000, gh_mask=fffffffffffff871
[31705.171040] CR3 = 0x00000000fffbc000
[31705.171041] RSP = 0x0000000000000007  RIP = 0x0000000000100000
[31705.171042] RFLAGS=0x00000ad0         DR7 = 0x0000000000000400
[31705.171043] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000
[31705.171044] CS:   sel=0x0000, attr=0x0009b, limit=0x0000ffff, base=0x0000000000000000
[31705.171045] DS:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
[31705.171046] SS:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
[31705.171046] ES:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
[31705.171047] FS:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
[31705.171048] GS:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
[31705.171049] GDTR:                           limit=0x0000ffff, base=0x0000000000000000
[31705.171050] LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000
[31705.171050] IDTR:                           limit=0x0000ffff, base=0x0000000000000000
[31705.171051] TR:   sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000
[31705.171052] EFER =     0x0000000000000000  PAT = 0x0007040600070406
[31705.171053] DebugCtl = 0x0000000000000000  DebugExceptions = 0x0000000000000000
[31705.171054] Interruptibility = 00000000  ActivityState = 00000000
[31705.171054] *** Host State ***
[31705.171055] RIP = 0xffffffffc0be5138  RSP = 0xffff8a4bc8967cd0
[31705.171056] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040
[31705.171057] FSBase=00007fe434945700 GSBase=ffff8a4bde240000 TRBase=ffff8a4bde256c80
[31705.171058] GDTBase=ffff8a4bde249000 IDTBase=ffffffffff57b000
[31705.171058] CR0=0000000080050033 CR3=00000001934aa000 CR4=00000000001426e0
[31705.171059] Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff86803e10
[31705.171060] EFER = 0x0000000000000d01  PAT = 0x0407010600070106
[31705.171061] *** Control State ***
[31705.171061] PinBased=0000003f CPUBased=b6a1edfe SecondaryExec=000000eb
[31705.171062] EntryControls=0000d1ff ExitControls=002fefff
[31705.171063] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000
[31705.171064] VMEntry: intr_info=800000ff errcode=00000000 ilen=00000000
[31705.171065] VMExit: intr_info=00000000 errcode=00000000 ilen=00000002
[31705.171065]         reason=80000021 qualification=0000000000000000
[31705.171066] IDTVectoring: info=00000000 errcode=00000000
[31705.171067] TSC Offset = 0xffffc75eb7825681
[31705.171067] TPR Threshold = 0x00
[31705.171068] EPT pointer = 0x000000019361301e
[31705.171069] Virtual processor ID = 0x0001

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Dmitry Vyukov]

On Mon, Nov 14, 2016 at 3:03 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
>
> On 14/11/2016 15:00, Dmitry Vyukov wrote:
>> Hello,
>>
>> The following program triggers WARNING in kvm_arch_vcpu_ioctl_run in
>> run in parallel loop:
>> https://gist.githubusercontent.com/dvyukov/08091eee6f38548ff9e6905c5e0eaaee/raw/8cae95f2e88eeb98c4ddc06d227670c1e248222f/gistfile1.txt
>>
>> On commit e234832afb623fe5c7d1d5703d6619494d8d703f (Nov 13)
>>
>> WARNING: CPU: 3 PID: 11141 at arch/x86/kvm/x86.c:6984
>> kvm_arch_vcpu_ioctl_run+0x1f0/0x4f50
>> CPU: 3 PID: 11141 Comm: syz-executor Not tainted 4.9.0-rc5+ #24
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>>  ffff880039cef698 ffffffff834c3959 ffffffff00000003 1ffff1000739de66
>>  ffffed000739de5e 0000000041b58ab3 ffffffff89576450 ffffffff834c366b
>>  0000000041b58ab3 ffffffff894d2830 ffffffff81590020 ffffffff810d90f0
>> Call Trace:
>>  [<     inline     >] __dump_stack lib/dump_stack.c:15
>>  [<ffffffff834c3959>] dump_stack+0x2ee/0x3f5 lib/dump_stack.c:51
>>  [<ffffffff81849908>] panic+0x200/0x425 kernel/panic.c:179
>>  [<ffffffff813fd919>] __warn+0x1c9/0x1e0 kernel/panic.c:542
>>  [<ffffffff813fdb81>] warn_slowpath_null+0x31/0x40 kernel/panic.c:585
>>  [<ffffffff810ee930>] kvm_arch_vcpu_ioctl_run+0x1f0/0x4f50
>> arch/x86/kvm/x86.c:6984
>>  [<ffffffff8107b328>] kvm_vcpu_ioctl+0x678/0x11c0
>> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557
>>  [<     inline     >] vfs_ioctl fs/ioctl.c:43
>>  [<ffffffff81abdb44>] do_vfs_ioctl+0x1c4/0x1630 fs/ioctl.c:679
>>  [<     inline     >] SYSC_ioctl fs/ioctl.c:694
>>  [<ffffffff81abf044>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:685
>>  [<ffffffff88144885>] entry_SYSCALL_64_fastpath+0x23/0xc6
>
> What I got for now is this dmesg splat:


I made dump_vmcs() no-op locally. You should see the warning
regardless, but probably it is difficult to notice. Or maybe tons of
output affect timings so that the warning does not happen.




> [31705.171034] *** Guest State ***
> [31705.171039] CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7
> [31705.171040] CR4: actual=0x0000000000002050, shadow=0x0000000000000000, gh_mask=fffffffffffff871
> [31705.171040] CR3 = 0x00000000fffbc000
> [31705.171041] RSP = 0x0000000000000007  RIP = 0x0000000000100000
> [31705.171042] RFLAGS=0x00000ad0         DR7 = 0x0000000000000400
> [31705.171043] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000
> [31705.171044] CS:   sel=0x0000, attr=0x0009b, limit=0x0000ffff, base=0x0000000000000000
> [31705.171045] DS:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
> [31705.171046] SS:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
> [31705.171046] ES:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
> [31705.171047] FS:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
> [31705.171048] GS:   sel=0x0000, attr=0x00093, limit=0x0000ffff, base=0x0000000000000000
> [31705.171049] GDTR:                           limit=0x0000ffff, base=0x0000000000000000
> [31705.171050] LDTR: sel=0x0000, attr=0x00082, limit=0x0000ffff, base=0x0000000000000000
> [31705.171050] IDTR:                           limit=0x0000ffff, base=0x0000000000000000
> [31705.171051] TR:   sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000
> [31705.171052] EFER =     0x0000000000000000  PAT = 0x0007040600070406
> [31705.171053] DebugCtl = 0x0000000000000000  DebugExceptions = 0x0000000000000000
> [31705.171054] Interruptibility = 00000000  ActivityState = 00000000
> [31705.171054] *** Host State ***
> [31705.171055] RIP = 0xffffffffc0be5138  RSP = 0xffff8a4bc8967cd0
> [31705.171056] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040
> [31705.171057] FSBase=00007fe434945700 GSBase=ffff8a4bde240000 TRBase=ffff8a4bde256c80
> [31705.171058] GDTBase=ffff8a4bde249000 IDTBase=ffffffffff57b000
> [31705.171058] CR0=0000000080050033 CR3=00000001934aa000 CR4=00000000001426e0
> [31705.171059] Sysenter RSP=0000000000000000 CS:RIP=0010:ffffffff86803e10
> [31705.171060] EFER = 0x0000000000000d01  PAT = 0x0407010600070106
> [31705.171061] *** Control State ***
> [31705.171061] PinBased=0000003f CPUBased=b6a1edfe SecondaryExec=000000eb
> [31705.171062] EntryControls=0000d1ff ExitControls=002fefff
> [31705.171063] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000
> [31705.171064] VMEntry: intr_info=800000ff errcode=00000000 ilen=00000000
> [31705.171065] VMExit: intr_info=00000000 errcode=00000000 ilen=00000002
> [31705.171065]         reason=80000021 qualification=0000000000000000
> [31705.171066] IDTVectoring: info=00000000 errcode=00000000
> [31705.171067] TSC Offset = 0xffffc75eb7825681
> [31705.171067] TPR Threshold = 0x00
> [31705.171068] EPT pointer = 0x000000019361301e
> [31705.171069] Virtual processor ID = 0x0001
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Paolo Bonzini]

On 14/11/2016 15:09, Dmitry Vyukov wrote:
> 
> I made dump_vmcs() no-op locally. You should see the warning
> regardless, but probably it is difficult to notice. Or maybe tons of
> output affect timings so that the warning does not happen.

I let it run for several minutes, and only got 50 splats out of several
thousand iterations.  Reproducing is not going to help much anyway---if
we can get to the root cause, writing a reliable reproducer would be
easier anyway.

Paolo

kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Dmitry Vyukov]

Hello,

syzkaller fuzzer has hit the following WARNING in kvm_arch_vcpu_ioctl_run.
This is easily reproducible and reproducer is attached at the bottom.
The report is on upstream commit
26c5cebfdb6ca799186f1e56be7d6f2480c5012c. This requires setting
kvm-intel.unrestricted_guest=0 on the machine, with
unrestricted_guest=1 the WARNING does not happen. Output of the
program is:

ret1=0 exit_reason=17 suberror=1
ret2=0 exit_reason=8 suberror=65530


WARNING: CPU: 1 PID: 2850 at arch/x86/kvm/x86.c:7223
kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7223
CPU: 1 PID: 2850 Comm: a.out Not tainted 4.13.0-rc3+ #445
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 panic+0x1e4/0x417 kernel/panic.c:180
 __warn+0x1c4/0x1d9 kernel/panic.c:541
 report_bug+0x211/0x2d0 lib/bug.c:183
 fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190
 do_trap_no_signal arch/x86/kernel/traps.c:224 [inline]
 do_trap+0x260/0x390 arch/x86/kernel/traps.c:273
 do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:310
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323
 invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:846
RIP: 0010:kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7222
RSP: 0018:ffff8800627cf670 EFLAGS: 00010297
RAX: ffff880066c44480 RBX: ffff88006b07f000 RCX: ffff880067d0845c
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880067d08260
RBP: ffff8800627cfa40 R08: 0000000000000001 R09: 0000000000000000
R10: ffff8800627cfa58 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: ffff88006b934880 R15: ffff880067d08040
 kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2592
 vfs_ioctl fs/ioctl.c:45 [inline]
 do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685
 SYSC_ioctl fs/ioctl.c:700 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x44ccc9
RSP: 002b:00007f9ecbc37db8 EFLAGS: 00000297 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044ccc9
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 0000000000000082 R08: 00007f9ecbc38700 R09: 0000000000000000
R10: 00007f9ecbc38700 R11: 0000000000000297 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9ecbc389c0 R15: 00007f9ecbc38700



// autogenerated by syzkaller (http://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <unistd.h>
#include <linux/kvm.h>
#include <stdio.h>

int kvmcpu;
struct kvm_run *run;

void* thr(void* arg)
{
  int res;
  res = ioctl(kvmcpu, KVM_RUN, 0);
  printf("ret1=%d exit_reason=%d suberror=%d\n",
      res, run->exit_reason, run->internal.suberror);
  return 0;
}

void test()
{
  int i, kvm, kvmvm;
  pthread_t th[4];

  kvm = open("/dev/kvm", O_RDWR);
  kvmvm = ioctl(kvm, KVM_CREATE_VM, 0);
  kvmcpu = ioctl(kvmvm, KVM_CREATE_VCPU, 0);
  run = (struct kvm_run*)mmap(0, 4096, PROT_READ|PROT_WRITE,
MAP_SHARED, kvmcpu, 0);
  srand(getpid());
  for (i = 0; i < 4; i++) {
    pthread_create(&th[i], 0, thr, 0);
    usleep(rand() % 10000);
  }
  for (i = 0; i < 4; i++)
    pthread_join(th[i], 0);
}

int main()
{
  for (;;) {
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      test();
      exit(0);
    }
    int status;
    while (waitpid(pid, &status, __WALL) != pid) {}
  }
  return 0;
}

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Dmitry Vyukov]

-non-existent email address

On Wed, Aug 9, 2017 at 7:07 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> syzkaller fuzzer has hit the following WARNING in kvm_arch_vcpu_ioctl_run.
> This is easily reproducible and reproducer is attached at the bottom.
> The report is on upstream commit
> 26c5cebfdb6ca799186f1e56be7d6f2480c5012c. This requires setting
> kvm-intel.unrestricted_guest=0 on the machine, with
> unrestricted_guest=1 the WARNING does not happen. Output of the
> program is:
>
> ret1=0 exit_reason=17 suberror=1
> ret2=0 exit_reason=8 suberror=65530
>
>
> WARNING: CPU: 1 PID: 2850 at arch/x86/kvm/x86.c:7223
> kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7223
> CPU: 1 PID: 2850 Comm: a.out Not tainted 4.13.0-rc3+ #445
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:16 [inline]
>  dump_stack+0x194/0x257 lib/dump_stack.c:52
>  panic+0x1e4/0x417 kernel/panic.c:180
>  __warn+0x1c4/0x1d9 kernel/panic.c:541
>  report_bug+0x211/0x2d0 lib/bug.c:183
>  fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190
>  do_trap_no_signal arch/x86/kernel/traps.c:224 [inline]
>  do_trap+0x260/0x390 arch/x86/kernel/traps.c:273
>  do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:310
>  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323
>  invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:846
> RIP: 0010:kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7222
> RSP: 0018:ffff8800627cf670 EFLAGS: 00010297
> RAX: ffff880066c44480 RBX: ffff88006b07f000 RCX: ffff880067d0845c
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880067d08260
> RBP: ffff8800627cfa40 R08: 0000000000000001 R09: 0000000000000000
> R10: ffff8800627cfa58 R11: 0000000000000000 R12: 0000000000000001
> R13: 0000000000000000 R14: ffff88006b934880 R15: ffff880067d08040
>  kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2592
>  vfs_ioctl fs/ioctl.c:45 [inline]
>  do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685
>  SYSC_ioctl fs/ioctl.c:700 [inline]
>  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
>  entry_SYSCALL_64_fastpath+0x1f/0xbe
> RIP: 0033:0x44ccc9
> RSP: 002b:00007f9ecbc37db8 EFLAGS: 00000297 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044ccc9
> RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
> RBP: 0000000000000082 R08: 00007f9ecbc38700 R09: 0000000000000000
> R10: 00007f9ecbc38700 R11: 0000000000000297 R12: 0000000000000000
> R13: 0000000000000000 R14: 00007f9ecbc389c0 R15: 00007f9ecbc38700
>
>
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #define _GNU_SOURCE
> #include <pthread.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/wait.h>
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <sys/mman.h>
> #include <fcntl.h>
> #include <unistd.h>
> #include <linux/kvm.h>
> #include <stdio.h>
>
> int kvmcpu;
> struct kvm_run *run;
>
> void* thr(void* arg)
> {
>   int res;
>   res = ioctl(kvmcpu, KVM_RUN, 0);
>   printf("ret1=%d exit_reason=%d suberror=%d\n",
>       res, run->exit_reason, run->internal.suberror);
>   return 0;
> }
>
> void test()
> {
>   int i, kvm, kvmvm;
>   pthread_t th[4];
>
>   kvm = open("/dev/kvm", O_RDWR);
>   kvmvm = ioctl(kvm, KVM_CREATE_VM, 0);
>   kvmcpu = ioctl(kvmvm, KVM_CREATE_VCPU, 0);
>   run = (struct kvm_run*)mmap(0, 4096, PROT_READ|PROT_WRITE,
> MAP_SHARED, kvmcpu, 0);
>   srand(getpid());
>   for (i = 0; i < 4; i++) {
>     pthread_create(&th[i], 0, thr, 0);
>     usleep(rand() % 10000);
>   }
>   for (i = 0; i < 4; i++)
>     pthread_join(th[i], 0);
> }
>
> int main()
> {
>   for (;;) {
>     int pid = fork();
>     if (pid < 0)
>       exit(1);
>     if (pid == 0) {
>       test();
>       exit(0);
>     }
>     int status;
>     while (waitpid(pid, &status, __WALL) != pid) {}
>   }
>   return 0;
> }

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Dmitry Vyukov]

On Wed, Aug 9, 2017 at 7:09 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> -non-existent email address
>
> On Wed, Aug 9, 2017 at 7:07 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
>> Hello,
>>
>> syzkaller fuzzer has hit the following WARNING in kvm_arch_vcpu_ioctl_run.
>> This is easily reproducible and reproducer is attached at the bottom.
>> The report is on upstream commit
>> 26c5cebfdb6ca799186f1e56be7d6f2480c5012c. This requires setting
>> kvm-intel.unrestricted_guest=0 on the machine, with
>> unrestricted_guest=1 the WARNING does not happen. Output of the
>> program is:
>>
>> ret1=0 exit_reason=17 suberror=1
>> ret2=0 exit_reason=8 suberror=65530
>>
>>
>> WARNING: CPU: 1 PID: 2850 at arch/x86/kvm/x86.c:7223
>> kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7223
>> CPU: 1 PID: 2850 Comm: a.out Not tainted 4.13.0-rc3+ #445
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> Call Trace:
>>  __dump_stack lib/dump_stack.c:16 [inline]
>>  dump_stack+0x194/0x257 lib/dump_stack.c:52
>>  panic+0x1e4/0x417 kernel/panic.c:180
>>  __warn+0x1c4/0x1d9 kernel/panic.c:541
>>  report_bug+0x211/0x2d0 lib/bug.c:183
>>  fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190
>>  do_trap_no_signal arch/x86/kernel/traps.c:224 [inline]
>>  do_trap+0x260/0x390 arch/x86/kernel/traps.c:273
>>  do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:310
>>  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323
>>  invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:846
>> RIP: 0010:kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7222
>> RSP: 0018:ffff8800627cf670 EFLAGS: 00010297
>> RAX: ffff880066c44480 RBX: ffff88006b07f000 RCX: ffff880067d0845c
>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880067d08260
>> RBP: ffff8800627cfa40 R08: 0000000000000001 R09: 0000000000000000
>> R10: ffff8800627cfa58 R11: 0000000000000000 R12: 0000000000000001
>> R13: 0000000000000000 R14: ffff88006b934880 R15: ffff880067d08040
>>  kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2592
>>  vfs_ioctl fs/ioctl.c:45 [inline]
>>  do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685
>>  SYSC_ioctl fs/ioctl.c:700 [inline]
>>  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
>>  entry_SYSCALL_64_fastpath+0x1f/0xbe
>> RIP: 0033:0x44ccc9
>> RSP: 002b:00007f9ecbc37db8 EFLAGS: 00000297 ORIG_RAX: 0000000000000010
>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044ccc9
>> RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
>> RBP: 0000000000000082 R08: 00007f9ecbc38700 R09: 0000000000000000
>> R10: 00007f9ecbc38700 R11: 0000000000000297 R12: 0000000000000000
>> R13: 0000000000000000 R14: 00007f9ecbc389c0 R15: 00007f9ecbc38700
>>
>>
>>
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> #define _GNU_SOURCE
>> #include <pthread.h>
>> #include <stdio.h>
>> #include <stdlib.h>
>> #include <string.h>
>> #include <sys/wait.h>
>> #include <sys/types.h>
>> #include <sys/stat.h>
>> #include <sys/mman.h>
>> #include <fcntl.h>
>> #include <unistd.h>
>> #include <linux/kvm.h>
>> #include <stdio.h>
>>
>> int kvmcpu;
>> struct kvm_run *run;
>>
>> void* thr(void* arg)
>> {
>>   int res;
>>   res = ioctl(kvmcpu, KVM_RUN, 0);
>>   printf("ret1=%d exit_reason=%d suberror=%d\n",
>>       res, run->exit_reason, run->internal.suberror);
>>   return 0;
>> }
>>
>> void test()
>> {
>>   int i, kvm, kvmvm;
>>   pthread_t th[4];
>>
>>   kvm = open("/dev/kvm", O_RDWR);
>>   kvmvm = ioctl(kvm, KVM_CREATE_VM, 0);
>>   kvmcpu = ioctl(kvmvm, KVM_CREATE_VCPU, 0);
>>   run = (struct kvm_run*)mmap(0, 4096, PROT_READ|PROT_WRITE,
>> MAP_SHARED, kvmcpu, 0);
>>   srand(getpid());
>>   for (i = 0; i < 4; i++) {
>>     pthread_create(&th[i], 0, thr, 0);
>>     usleep(rand() % 10000);
>>   }
>>   for (i = 0; i < 4; i++)
>>     pthread_join(th[i], 0);
>> }
>>
>> int main()
>> {
>>   for (;;) {
>>     int pid = fork();
>>     if (pid < 0)
>>       exit(1);
>>     if (pid == 0) {
>>       test();
>>       exit(0);
>>     }
>>     int status;
>>     while (waitpid(pid, &status, __WALL) != pid) {}
>>   }
>>   return 0;
>> }



For the record, James suggested the following patch, but it does _not_ help:

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 6c97c82814c4..21391c9241bc 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5383,6 +5383,7 @@ static int handle_emulation_failure(struct kvm_vcpu *vcpu)
                vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
                vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
                vcpu->run->internal.ndata = 0;
+               vcpu->arch.pio.count = 0;
                r = EMULATE_FAIL;
        }
        kvm_queue_exception(vcpu, UD_VECTOR);

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[David Hildenbrand]

On 09.08.2017 19:07, Dmitry Vyukov wrote:
> Hello,
> 
> syzkaller fuzzer has hit the following WARNING in kvm_arch_vcpu_ioctl_run.
> This is easily reproducible and reproducer is attached at the bottom.
> The report is on upstream commit
> 26c5cebfdb6ca799186f1e56be7d6f2480c5012c. This requires setting
> kvm-intel.unrestricted_guest=0 on the machine, with
> unrestricted_guest=1 the WARNING does not happen. Output of the
> program is:
> 
> ret1=0 exit_reason=17 suberror=1
> ret2=0 exit_reason=8 suberror=65530
> 
> 

I wonder if the following is possible:

1) we set vcpu->arch.pio.count != 0

2) we set vcpu->arch.complete_userspace_io = complete_emulated_pio;
(in x86_emulate_instruction)

3) in kvm_arch_vcpu_ioctl_run(), we execute
vcpu->arch.complete_userspace_io and set it to NULL.

4. complete_emulated_pio() calls complete_emulated_io(), which fails
(in some different way) and leaves vcpu->arch.pio.count set.

5. we now have vcpu->arch.pio.count set but
vcpu->arch.complete_userspace_io cleared.

Same should not apply to vcpu->mmio_needed, as we clear it before
calling complete_emulated_io() in complete_emulated_mmio().

AFAIK, we cannot simply clear vcpu->arch.pio.count before calling
complete_emulated_io().

Maybe something like this could help: (untested, wild guess)


diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 86242ee..60296fef 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7227,10 +7227,14 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
                int (*cui)(struct kvm_vcpu *) = vcpu->arch.complete_userspace_io;
                vcpu->arch.complete_userspace_io = NULL;
                r = cui(vcpu);
+               if (!vcpu->arch.complete_userspace_io) {
+                       /* no new handler -> everything handled */
+                       vcpu->arch.pio.count = 0;
+                       vcpu->mmio_needed = 0;
+               }
                if (r <= 0)
                        goto out;
-       } else
-               WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed);
+       }
 
        if (kvm_run->immediate_exit)
                r = -EINTR;


Alternatively, something like this


diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 86242ee..58be388 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7127,9 +7127,15 @@ static inline int complete_emulated_io(struct kvm_vcpu *vcpu)
 
 static int complete_emulated_pio(struct kvm_vcpu *vcpu)
 {
+       int ret;
+
        BUG_ON(!vcpu->arch.pio.count);
 
-       return complete_emulated_io(vcpu);
+       ret = complete_emulated_io(vcpu);
+       if (ret && !vcpu->arch.complete_userspace_io)
+               vcpu->arch.pio.count = 0;
+
+       return ret;
 }
 
 /*


Haven't tried to reproduce on upstream yet (at least on my Fedora 25
I can't trigger it), so only wild guesses.

-- 

Thanks,

David

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Dmitry Vyukov]

On Wed, Aug 9, 2017 at 10:24 PM, David Hildenbrand <david@redhat.com> wrote:
> On 09.08.2017 19:07, Dmitry Vyukov wrote:
>> Hello,
>>
>> syzkaller fuzzer has hit the following WARNING in kvm_arch_vcpu_ioctl_run.
>> This is easily reproducible and reproducer is attached at the bottom.
>> The report is on upstream commit
>> 26c5cebfdb6ca799186f1e56be7d6f2480c5012c. This requires setting
>> kvm-intel.unrestricted_guest=0 on the machine, with
>> unrestricted_guest=1 the WARNING does not happen. Output of the
>> program is:
>>
>> ret1=0 exit_reason=17 suberror=1
>> ret2=0 exit_reason=8 suberror=65530
>>
>>
>
> I wonder if the following is possible:
>
> 1) we set vcpu->arch.pio.count != 0
>
> 2) we set vcpu->arch.complete_userspace_io = complete_emulated_pio;
> (in x86_emulate_instruction)
>
> 3) in kvm_arch_vcpu_ioctl_run(), we execute
> vcpu->arch.complete_userspace_io and set it to NULL.
>
> 4. complete_emulated_pio() calls complete_emulated_io(), which fails
> (in some different way) and leaves vcpu->arch.pio.count set.
>
> 5. we now have vcpu->arch.pio.count set but
> vcpu->arch.complete_userspace_io cleared.
>
> Same should not apply to vcpu->mmio_needed, as we clear it before
> calling complete_emulated_io() in complete_emulated_mmio().
>
> AFAIK, we cannot simply clear vcpu->arch.pio.count before calling
> complete_emulated_io().
>
> Maybe something like this could help: (untested, wild guess)
>
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 86242ee..60296fef 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -7227,10 +7227,14 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
>                 int (*cui)(struct kvm_vcpu *) = vcpu->arch.complete_userspace_io;
>                 vcpu->arch.complete_userspace_io = NULL;
>                 r = cui(vcpu);
> +               if (!vcpu->arch.complete_userspace_io) {
> +                       /* no new handler -> everything handled */
> +                       vcpu->arch.pio.count = 0;
> +                       vcpu->mmio_needed = 0;
> +               }
>                 if (r <= 0)
>                         goto out;
> -       } else
> -               WARN_ON(vcpu->arch.pio.count || vcpu->mmio_needed);
> +       }
>
>         if (kvm_run->immediate_exit)
>                 r = -EINTR;
>
>
> Alternatively, something like this
>
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 86242ee..58be388 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -7127,9 +7127,15 @@ static inline int complete_emulated_io(struct kvm_vcpu *vcpu)
>
>  static int complete_emulated_pio(struct kvm_vcpu *vcpu)
>  {
> +       int ret;
> +
>         BUG_ON(!vcpu->arch.pio.count);
>
> -       return complete_emulated_io(vcpu);
> +       ret = complete_emulated_io(vcpu);
> +       if (ret && !vcpu->arch.complete_userspace_io)
> +               vcpu->arch.pio.count = 0;
> +
> +       return ret;
>  }
>
>  /*
>
>
> Haven't tried to reproduce on upstream yet (at least on my Fedora 25
> I can't trigger it), so only wild guesses.


It is know to happen back to at least 4.3. Make sure you have
kvm-intel.unrestricted_guest=0, it does not reproduce without it (at
least not with this program).

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Wanpeng Li]

2017-08-10 1:07 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>:
> Hello,
>
> syzkaller fuzzer has hit the following WARNING in kvm_arch_vcpu_ioctl_run.
> This is easily reproducible and reproducer is attached at the bottom.
> The report is on upstream commit
> 26c5cebfdb6ca799186f1e56be7d6f2480c5012c. This requires setting
> kvm-intel.unrestricted_guest=0 on the machine, with
> unrestricted_guest=1 the WARNING does not happen. Output of the
> program is:
>
> ret1=0 exit_reason=17 suberror=1
> ret2=0 exit_reason=8 suberror=65530
>
>
> WARNING: CPU: 1 PID: 2850 at arch/x86/kvm/x86.c:7223
> kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7223
> CPU: 1 PID: 2850 Comm: a.out Not tainted 4.13.0-rc3+ #445
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:16 [inline]
>  dump_stack+0x194/0x257 lib/dump_stack.c:52
>  panic+0x1e4/0x417 kernel/panic.c:180
>  __warn+0x1c4/0x1d9 kernel/panic.c:541
>  report_bug+0x211/0x2d0 lib/bug.c:183
>  fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190
>  do_trap_no_signal arch/x86/kernel/traps.c:224 [inline]
>  do_trap+0x260/0x390 arch/x86/kernel/traps.c:273
>  do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:310
>  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323
>  invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:846
> RIP: 0010:kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7222
> RSP: 0018:ffff8800627cf670 EFLAGS: 00010297
> RAX: ffff880066c44480 RBX: ffff88006b07f000 RCX: ffff880067d0845c
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880067d08260
> RBP: ffff8800627cfa40 R08: 0000000000000001 R09: 0000000000000000
> R10: ffff8800627cfa58 R11: 0000000000000000 R12: 0000000000000001
> R13: 0000000000000000 R14: ffff88006b934880 R15: ffff880067d08040
>  kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2592
>  vfs_ioctl fs/ioctl.c:45 [inline]
>  do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685
>  SYSC_ioctl fs/ioctl.c:700 [inline]
>  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
>  entry_SYSCALL_64_fastpath+0x1f/0xbe
> RIP: 0033:0x44ccc9
> RSP: 002b:00007f9ecbc37db8 EFLAGS: 00000297 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044ccc9
> RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
> RBP: 0000000000000082 R08: 00007f9ecbc38700 R09: 0000000000000000
> R10: 00007f9ecbc38700 R11: 0000000000000297 R12: 0000000000000000
> R13: 0000000000000000 R14: 00007f9ecbc389c0 R15: 00007f9ecbc38700
>
>
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #define _GNU_SOURCE
> #include <pthread.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/wait.h>
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <sys/mman.h>
> #include <fcntl.h>
> #include <unistd.h>
> #include <linux/kvm.h>
> #include <stdio.h>
>
> int kvmcpu;
> struct kvm_run *run;
>
> void* thr(void* arg)
> {
>   int res;
>   res = ioctl(kvmcpu, KVM_RUN, 0);
>   printf("ret1=%d exit_reason=%d suberror=%d\n",
>       res, run->exit_reason, run->internal.suberror);
>   return 0;
> }
>
> void test()
> {
>   int i, kvm, kvmvm;
>   pthread_t th[4];
>
>   kvm = open("/dev/kvm", O_RDWR);
>   kvmvm = ioctl(kvm, KVM_CREATE_VM, 0);
>   kvmcpu = ioctl(kvmvm, KVM_CREATE_VCPU, 0);
>   run = (struct kvm_run*)mmap(0, 4096, PROT_READ|PROT_WRITE,
> MAP_SHARED, kvmcpu, 0);
>   srand(getpid());
>   for (i = 0; i < 4; i++) {
>     pthread_create(&th[i], 0, thr, 0);
>     usleep(rand() % 10000);
>   }
>   for (i = 0; i < 4; i++)
>     pthread_join(th[i], 0);
> }
>
> int main()
> {
>   for (;;) {
>     int pid = fork();
>     if (pid < 0)
>       exit(1);
>     if (pid == 0) {
>       test();
>       exit(0);
>     }
>     int status;
>     while (waitpid(pid, &status, __WALL) != pid) {}
>   }
>   return 0;
> }

Thanks for the report and I can reproduce, I will take a look.

Regards,
Wanpeng Li

Re: kvm: WARNING in kvm_arch_vcpu_ioctl_run

[Wanpeng Li]

2017-08-10 1:07 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>:
> Hello,
>
> syzkaller fuzzer has hit the following WARNING in kvm_arch_vcpu_ioctl_run.
> This is easily reproducible and reproducer is attached at the bottom.
> The report is on upstream commit
> 26c5cebfdb6ca799186f1e56be7d6f2480c5012c. This requires setting
> kvm-intel.unrestricted_guest=0 on the machine, with
> unrestricted_guest=1 the WARNING does not happen. Output of the
> program is:
>
> ret1=0 exit_reason=17 suberror=1
> ret2=0 exit_reason=8 suberror=65530

Please have a try. https://lkml.org/lkml/2017/8/10/27

Regards,
Wanpeng Li

>
>
> WARNING: CPU: 1 PID: 2850 at arch/x86/kvm/x86.c:7223
> kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7223
> CPU: 1 PID: 2850 Comm: a.out Not tainted 4.13.0-rc3+ #445
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:16 [inline]
>  dump_stack+0x194/0x257 lib/dump_stack.c:52
>  panic+0x1e4/0x417 kernel/panic.c:180
>  __warn+0x1c4/0x1d9 kernel/panic.c:541
>  report_bug+0x211/0x2d0 lib/bug.c:183
>  fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190
>  do_trap_no_signal arch/x86/kernel/traps.c:224 [inline]
>  do_trap+0x260/0x390 arch/x86/kernel/traps.c:273
>  do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:310
>  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323
>  invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:846
> RIP: 0010:kvm_arch_vcpu_ioctl_run+0x213/0x5870 arch/x86/kvm/x86.c:7222
> RSP: 0018:ffff8800627cf670 EFLAGS: 00010297
> RAX: ffff880066c44480 RBX: ffff88006b07f000 RCX: ffff880067d0845c
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880067d08260
> RBP: ffff8800627cfa40 R08: 0000000000000001 R09: 0000000000000000
> R10: ffff8800627cfa58 R11: 0000000000000000 R12: 0000000000000001
> R13: 0000000000000000 R14: ffff88006b934880 R15: ffff880067d08040
>  kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2592
>  vfs_ioctl fs/ioctl.c:45 [inline]
>  do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685
>  SYSC_ioctl fs/ioctl.c:700 [inline]
>  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
>  entry_SYSCALL_64_fastpath+0x1f/0xbe
> RIP: 0033:0x44ccc9
> RSP: 002b:00007f9ecbc37db8 EFLAGS: 00000297 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044ccc9
> RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
> RBP: 0000000000000082 R08: 00007f9ecbc38700 R09: 0000000000000000
> R10: 00007f9ecbc38700 R11: 0000000000000297 R12: 0000000000000000
> R13: 0000000000000000 R14: 00007f9ecbc389c0 R15: 00007f9ecbc38700
>
>
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #define _GNU_SOURCE
> #include <pthread.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/wait.h>
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <sys/mman.h>
> #include <fcntl.h>
> #include <unistd.h>
> #include <linux/kvm.h>
> #include <stdio.h>
>
> int kvmcpu;
> struct kvm_run *run;
>
> void* thr(void* arg)
> {
>   int res;
>   res = ioctl(kvmcpu, KVM_RUN, 0);
>   printf("ret1=%d exit_reason=%d suberror=%d\n",
>       res, run->exit_reason, run->internal.suberror);
>   return 0;
> }
>
> void test()
> {
>   int i, kvm, kvmvm;
>   pthread_t th[4];
>
>   kvm = open("/dev/kvm", O_RDWR);
>   kvmvm = ioctl(kvm, KVM_CREATE_VM, 0);
>   kvmcpu = ioctl(kvmvm, KVM_CREATE_VCPU, 0);
>   run = (struct kvm_run*)mmap(0, 4096, PROT_READ|PROT_WRITE,
> MAP_SHARED, kvmcpu, 0);
>   srand(getpid());
>   for (i = 0; i < 4; i++) {
>     pthread_create(&th[i], 0, thr, 0);
>     usleep(rand() % 10000);
>   }
>   for (i = 0; i < 4; i++)
>     pthread_join(th[i], 0);
> }
>
> int main()
> {
>   for (;;) {
>     int pid = fork();
>     if (pid < 0)
>       exit(1);
>     if (pid == 0) {
>       test();
>       exit(0);
>     }
>     int status;
>     while (waitpid(pid, &status, __WALL) != pid) {}
>   }
>   return 0;
> }