Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[Muhammad Usama Anjum]

On 5/5/23 1:28 PM, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
This same warning has also been found on  6.1.21.

> git tree: linux-5.15.y
> console output: https://syzkaller.appspot.com/x/log.txt?x=15f12318280000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ba8d5c9d6c5289f
> dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
> compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e13c84280000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=149d9470280000
I've tried all the C and syz reproducers. I've also tried syz-crash which
launched multiple instances of VMs and ran syz reproducer. But the issue
didn't get reproduced.

I don't have kvm skills. Can someone have a look at the the warning
(probably by static analysis)?

> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/fc04f54c047f/disk-8a7f2a5c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6b4ba4cb1191/vmlinux-8a7f2a5c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/d927dc3f9670/bzImage-8a7f2a5c.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+412c9ae97b4338c5187e@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 3502 at arch/x86/kvm/x86.c:10310 kvm_arch_vcpu_ioctl_run+0x1d63/0x1f80
> Modules linked in:
> CPU: 1 PID: 3502 Comm: syz-executor306 Not tainted 5.15.110-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
> RIP: 0010:kvm_arch_vcpu_ioctl_run+0x1d63/0x1f80 arch/x86/kvm/x86.c:10310
> Code: df e8 71 ac b9 00 e9 e5 fa ff ff 89 d9 80 e1 07 38 c1 0f 8c 26 fb ff ff 48 89 df e8 57 ac b9 00 e9 19 fb ff ff e8 4d 52 70 00 <0f> 0b e9 e0 fb ff ff 89 d9 80 e1 07 38 c1 0f 8c 63 fb ff ff 48 89
> RSP: 0018:ffffc90002bcfc60 EFLAGS: 00010293
> RAX: ffffffff810f8c33 RBX: 0000000000000000 RCX: ffff888012bc1d00
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
> RBP: dffffc0000000000 R08: ffffffff8116a882 R09: fffffbfff1bc744e
> R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888012bc1d00
> R13: ffff888077580000 R14: ffff8880775800f0 R15: ffff88801e2a9000
> FS: 000055555696f300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fafc4b53130 CR3: 000000007c8ce000 CR4: 00000000003526e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> kvm_vcpu_ioctl+0x7f0/0xcf0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3863
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:874 [inline]
> __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x61/0xcb
> RIP: 0033:0x7fafc4ae1ed9
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffd3bb98a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 000000000000cdf3 RCX: 00007fafc4ae1ed9
> RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
> RBP: 0000000000000000 R08: 00007ffd3bb98be8 R09: 00007ffd3bb98be8
> R10: 00007ffd3bb98be8 R11: 0000000000000246 R12: 00007ffd3bb98a5c
> R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
> </TASK>
> 
> 
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
> 

-- 
BR,
Muhammad Usama Anjum

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[Sean Christopherson]

On Mon, Aug 28, 2023, Muhammad Usama Anjum wrote:
> On 5/5/23 1:28 PM, syzbot wrote:
> > syzbot has found a reproducer for the following issue on:
> > 
> > HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
> This same warning has also been found on  6.1.21.
> 
> > git tree: linux-5.15.y
> > console output: https://syzkaller.appspot.com/x/log.txt?x=15f12318280000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=ba8d5c9d6c5289f
> > dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
> > compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e13c84280000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=149d9470280000
> I've tried all the C and syz reproducers. I've also tried syz-crash which
> launched multiple instances of VMs and ran syz reproducer. But the issue
> didn't get reproduced.
> 
> I don't have kvm skills. Can someone have a look at the the warning
> (probably by static analysis)?
> 
> > 
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/fc04f54c047f/disk-8a7f2a5c.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/6b4ba4cb1191/vmlinux-8a7f2a5c.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/d927dc3f9670/bzImage-8a7f2a5c.xz
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+412c9ae97b4338c5187e@syzkaller.appspotmail.com
> > 
> > ------------[ cut here ]------------
> > WARNING: CPU: 0 PID: 3502 at arch/x86/kvm/x86.c:10310 kvm_arch_vcpu_ioctl_run+0x1d63/0x1f80

"Fixed" by https://lore.kernel.org/all/20230808232057.2498287-1-seanjc@google.com,
in quotes because sadly the fix was to simply delete the sanity check :-(

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[Muhammad Usama Anjum]

On Monday, August 28, 2023 08:11 PM PKT, Sean Christopherson <seanjc@google.com> wrote:

> On Mon, Aug 28, 2023, Muhammad Usama Anjum wrote:
> > On 5/5/23 1:28 PM, syzbot wrote:
> > > syzbot has found a reproducer for the following issue on:
> > > 
> > > HEAD commit: 8a7f2a5c5aa1 Linux 5.15.110
> > This same warning has also been found on  6.1.21.
> > 
> > > git tree: linux-5.15.y
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=15f12318280000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=ba8d5c9d6c5289f
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
> > > compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e13c84280000
> > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=149d9470280000
> > I've tried all the C and syz reproducers. I've also tried syz-crash which
> > launched multiple instances of VMs and ran syz reproducer. But the issue
> > didn't get reproduced.
> > 
> > I don't have kvm skills. Can someone have a look at the the warning
> > (probably by static analysis)?
> > 
> > > 
> > > Downloadable assets:
> > > disk image: https://storage.googleapis.com/syzbot-assets/fc04f54c047f/disk-8a7f2a5c.raw.xz
> > > vmlinux: https://storage.googleapis.com/syzbot-assets/6b4ba4cb1191/vmlinux-8a7f2a5c.xz
> > > kernel image: https://storage.googleapis.com/syzbot-assets/d927dc3f9670/bzImage-8a7f2a5c.xz
> > > 
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+412c9ae97b4338c5187e@syzkaller.appspotmail.com
> > > 
> > > ------------[ cut here ]------------
> > > WARNING: CPU: 0 PID: 3502 at arch/x86/kvm/x86.c:10310 kvm_arch_vcpu_ioctl_run+0x1d63/0x1f80
> 
> "Fixed" by https://lore.kernel.org/all/20230808232057.2498287-1-seanjc@google.com,
> in quotes because sadly the fix was to simply delete the sanity check :-(

Thank you so much Sean. Thank you so much Sean. Syzbot has been finding the issue in LTS kernels. I'm not sure if we should backport a patch which is just removing a false warning. 

#syz fix: KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[syzbot]

This bug is marked as fixed by commit:
KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU

But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:

#syz fix: exact-commit-title

Until then the bug is still considered open and new crashes with
the same signature are ignored.

Kernel: Linux 5.15
Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e

---
[1] I expect the commit to be present in:

1. linux-5.15.y branch of
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[Muhammad Usama Anjum]

On 11/26/23 8:24 PM, syzbot wrote:
> This bug is marked as fixed by commit:
> KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU
> 
> But I can't find it in the tested trees[1] for more than 90 days.
The commit is already in 6.7-rc3:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7b0151caf73a656b75b550e361648430233455a0

> Is it a correct commit? Please update it by replying:
> 
> #syz fix: exact-commit-title
The title is already correct.

> 
> Until then the bug is still considered open and new crashes with
> the same signature are ignored.
> 
> Kernel: Linux 5.15
> Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
> 
> ---
> [1] I expect the commit to be present in:
> 
> 1. linux-5.15.y branch of
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

-- 
BR,
Muhammad Usama Anjum

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[syzbot]

This bug is marked as fixed by commit:
KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU

But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:

#syz fix: exact-commit-title

Until then the bug is still considered open and new crashes with
the same signature are ignored.

Kernel: Linux 5.15
Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e

---
[1] I expect the commit to be present in:

1. linux-5.15.y branch of
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[syzbot]

This bug is marked as fixed by commit:
KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU

But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:

#syz fix: exact-commit-title

Until then the bug is still considered open and new crashes with
the same signature are ignored.

Kernel: Linux 5.15
Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e

---
[1] I expect the commit to be present in:

1. linux-5.15.y branch of
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[syzbot]

This bug is marked as fixed by commit:
KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU

But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:

#syz fix: exact-commit-title

Until then the bug is still considered open and new crashes with
the same signature are ignored.

Kernel: Linux 5.15
Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e

---
[1] I expect the commit to be present in:

1. linux-5.15.y branch of
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

Re: [v5.15] WARNING in kvm_arch_vcpu_ioctl_run

[Muhammad Usama Anjum]

On 1/9/24 11:18 PM, syzbot wrote:
> This bug is marked as fixed by commit:
> KVM: x86: Remove WARN sanity check on hypervisor timer vs. UNINITIALIZED vCPU
> 
> But I can't find it in the tested trees[1] for more than 90 days.
Just found out that the fix hasn't been back ported to this kernel. The fix
could be backported and sent to be included in this stable kernel.

#syz unfix

> Is it a correct commit? Please update it by replying:
> 
> #syz fix: exact-commit-title
> 
> Until then the bug is still considered open and new crashes with
> the same signature are ignored.
> 
> Kernel: Linux 5.15
> Dashboard link: https://syzkaller.appspot.com/bug?extid=412c9ae97b4338c5187e
> 
> ---
> [1] I expect the commit to be present in:
> 
> 1. linux-5.15.y branch of
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git

-- 
BR,
Muhammad Usama Anjum