* [syzbot] [kvm-x86?] WARNING in kvm_apic_accept_events (2) @ 2025-11-25 16:32 syzbot 2025-11-25 20:29 ` syzbot 0 siblings, 1 reply; 5+ messages in thread From: syzbot @ 2025-11-25 16:32 UTC (permalink / raw) To: bp, dave.hansen, hpa, kvm, linux-kernel, mingo, pbonzini, seanjc, syzkaller-bugs, tglx, x86 Hello, syzbot found the following issue on: HEAD commit: ac3fd01e4c1e Linux 6.18-rc7 git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17cdc57c580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f dashboard link: https://syzkaller.appspot.com/bug?extid=59f2c3a3fc4f6c09b8cd compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-ac3fd01e.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/b4f3c9fb005b/vmlinux-ac3fd01e.xz kernel image: https://storage.googleapis.com/syzbot-assets/93777421b2a4/bzImage-ac3fd01e.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+59f2c3a3fc4f6c09b8cd@syzkaller.appspotmail.com loop0: detected capacity change from 0 to 40427 F2FS-fs (loop0): Image doesn't support compression F2FS-fs (loop0): build fault injection rate: 551 F2FS-fs (loop0): build fault injection type: 0x2 F2FS-fs (loop0): invalid crc value F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5324 at arch/x86/kvm/lapic.c:3483 kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 Modules linked in: CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 Code: eb 0c e8 32 da 71 00 eb 05 e8 2b da 71 00 45 31 ff 44 89 f8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 10 da 71 00 90 <0f> 0b 90 e9 ec fd ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 4f RSP: 0018:ffffc9000d4bfbf0 EFLAGS: 00010287 RAX: ffffffff814e3940 RBX: 0000000000000002 RCX: 0000000000100000 RDX: ffffc9000e20a000 RSI: 0000000000000341 RDI: 0000000000000342 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff814689b6 R10: dffffc0000000000 R11: ffffed100818c008 R12: 0000000000000002 R13: dffffc0000000000 R14: ffff8880515c1e00 R15: ffff888040c602d8 FS: 00007f1fff0686c0(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8420d909c0 CR3: 0000000042c75000 CR4: 0000000000352ef0 Call Trace: <TASK> kvm_arch_vcpu_ioctl_get_mpstate+0x128/0x480 arch/x86/kvm/x86.c:12147 kvm_vcpu_ioctl+0x625/0xe90 virt/kvm/kvm_main.c:4539 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1ffe18f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f1fff068038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f1ffe3e5fa0 RCX: 00007f1ffe18f749 RDX: 00002000000000c0 RSI: 000000008004ae98 RDI: 0000000000000005 RBP: 00007f1ffe213f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1ffe3e6038 R14: 00007f1ffe3e5fa0 R15: 00007fff6a9934c8 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [kvm-x86?] WARNING in kvm_apic_accept_events (2) 2025-11-25 16:32 [syzbot] [kvm-x86?] WARNING in kvm_apic_accept_events (2) syzbot @ 2025-11-25 20:29 ` syzbot 2025-11-25 23:09 ` Sean Christopherson 0 siblings, 1 reply; 5+ messages in thread From: syzbot @ 2025-11-25 20:29 UTC (permalink / raw) To: bp, dave.hansen, hpa, kvm, linux-kernel, mingo, pbonzini, seanjc, syzkaller-bugs, tglx, x86 syzbot has found a reproducer for the following issue on: HEAD commit: 8a2bcda5e139 Merge tag 'for-6.18/dm-fixes' of git://git.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1604f8b4580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f dashboard link: https://syzkaller.appspot.com/bug?extid=59f2c3a3fc4f6c09b8cd compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ecf612580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d9cf42580000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-8a2bcda5.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/fc3f96645396/vmlinux-8a2bcda5.xz kernel image: https://storage.googleapis.com/syzbot-assets/e20aa7be5d33/bzImage-8a2bcda5.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+59f2c3a3fc4f6c09b8cd@syzkaller.appspotmail.com ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5495 at arch/x86/kvm/lapic.c:3483 kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 Modules linked in: CPU: 0 UID: 0 PID: 5495 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 Code: eb 0c e8 32 da 71 00 eb 05 e8 2b da 71 00 45 31 ff 44 89 f8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 10 da 71 00 90 <0f> 0b 90 e9 ec fd ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 4f RSP: 0018:ffffc90002b2fbf0 EFLAGS: 00010293 RAX: ffffffff814e3940 RBX: 0000000000000002 RCX: ffff88801f8ca480 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff814689b6 R10: dffffc0000000000 R11: ffffed1002268008 R12: 0000000000000002 R13: dffffc0000000000 R14: ffff888042c95c00 R15: ffff8880113402d8 FS: 000055558ab60500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000002000 CR3: 0000000058d0b000 CR4: 0000000000352ef0 Call Trace: <TASK> kvm_arch_vcpu_ioctl_get_mpstate+0x128/0x480 arch/x86/kvm/x86.c:12147 kvm_vcpu_ioctl+0x625/0xe90 virt/kvm/kvm_main.c:4539 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f918bd8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc74a3c2a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f918bfe5fa0 RCX: 00007f918bd8f749 RDX: 0000000000000000 RSI: 000000008004ae98 RDI: 0000000000000005 RBP: 00007f918be13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f918bfe5fa0 R14: 00007f918bfe5fa0 R15: 0000000000000003 </TASK> --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [kvm-x86?] WARNING in kvm_apic_accept_events (2) 2025-11-25 20:29 ` syzbot @ 2025-11-25 23:09 ` Sean Christopherson 2026-01-22 16:41 ` Alexander Potapenko 0 siblings, 1 reply; 5+ messages in thread From: Sean Christopherson @ 2025-11-25 23:09 UTC (permalink / raw) To: syzbot Cc: bp, dave.hansen, hpa, kvm, linux-kernel, mingo, pbonzini, syzkaller-bugs, tglx, x86 On Tue, Nov 25, 2025, syzbot wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 8a2bcda5e139 Merge tag 'for-6.18/dm-fixes' of git://git.ke.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=1604f8b4580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f > dashboard link: https://syzkaller.appspot.com/bug?extid=59f2c3a3fc4f6c09b8cd > compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ecf612580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d9cf42580000 > > Downloadable assets: > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-8a2bcda5.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/fc3f96645396/vmlinux-8a2bcda5.xz > kernel image: https://storage.googleapis.com/syzbot-assets/e20aa7be5d33/bzImage-8a2bcda5.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+59f2c3a3fc4f6c09b8cd@syzkaller.appspotmail.com > > ------------[ cut here ]------------ > WARNING: CPU: 0 PID: 5495 at arch/x86/kvm/lapic.c:3483 kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 > Modules linked in: > CPU: 0 UID: 0 PID: 5495 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 > RIP: 0010:kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 > Code: eb 0c e8 32 da 71 00 eb 05 e8 2b da 71 00 45 31 ff 44 89 f8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 10 da 71 00 90 <0f> 0b 90 e9 ec fd ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 4f > RSP: 0018:ffffc90002b2fbf0 EFLAGS: 00010293 > RAX: ffffffff814e3940 RBX: 0000000000000002 RCX: ffff88801f8ca480 > RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 > RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff814689b6 > R10: dffffc0000000000 R11: ffffed1002268008 R12: 0000000000000002 > R13: dffffc0000000000 R14: ffff888042c95c00 R15: ffff8880113402d8 > FS: 000055558ab60500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000200000002000 CR3: 0000000058d0b000 CR4: 0000000000352ef0 > Call Trace: > <TASK> > kvm_arch_vcpu_ioctl_get_mpstate+0x128/0x480 arch/x86/kvm/x86.c:12147 > kvm_vcpu_ioctl+0x625/0xe90 virt/kvm/kvm_main.c:4539 > vfs_ioctl fs/ioctl.c:51 [inline] > __do_sys_ioctl fs/ioctl.c:597 [inline] > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > RIP: 0033:0x7f918bd8f749 > Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007ffc74a3c2a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > RAX: ffffffffffffffda RBX: 00007f918bfe5fa0 RCX: 00007f918bd8f749 > RDX: 0000000000000000 RSI: 000000008004ae98 RDI: 0000000000000005 > RBP: 00007f918be13f91 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > R13: 00007f918bfe5fa0 R14: 00007f918bfe5fa0 R15: 0000000000000003 > </TASK> Syzbot outsmarted me once again. I thought I had made this impossible in commit 0fe3e8d804fd ("KVM: x86: Move INIT_RECEIVED vs. INIT/SIPI blocked check to KVM_RUN"), but now syzkaller is triggering the WARN by swapping the order and stuffing VMXON after INIT (ignore the EINVAL, KVM gets through enter_vmx_operation() before detecting bad guest state). ioctl(5, KVM_SET_MP_STATE, 0x200000000000) = 0 ioctl(5, KVM_SET_NESTED_STATE, 0x200000000a80) = -1 EINVAL (Invalid argument) ioctl(5, KVM_GET_MP_STATE, 0) = -1 EFAULT (Bad address) At this point, I'm leaning strongly towards dropping the WARN as it's not helping, and userspace doing odd things is completely uninteresting. diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c index 7b1b8f450f4c..df2a69da11b7 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -3521,7 +3521,6 @@ int kvm_apic_accept_events(struct kvm_vcpu *vcpu) * wait-for-SIPI (WFS). */ if (!kvm_apic_init_sipi_allowed(vcpu)) { - WARN_ON_ONCE(vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED); clear_bit(KVM_APIC_SIPI, &apic->pending_events); return 0; } ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [syzbot] [kvm-x86?] WARNING in kvm_apic_accept_events (2) 2025-11-25 23:09 ` Sean Christopherson @ 2026-01-22 16:41 ` Alexander Potapenko 2026-01-22 18:10 ` Sean Christopherson 0 siblings, 1 reply; 5+ messages in thread From: Alexander Potapenko @ 2026-01-22 16:41 UTC (permalink / raw) To: Sean Christopherson Cc: syzbot, bp, dave.hansen, hpa, kvm, linux-kernel, mingo, pbonzini, syzkaller-bugs, tglx, x86 On Wed, Nov 26, 2025 at 12:10 AM 'Sean Christopherson' via syzkaller-bugs <syzkaller-bugs@googlegroups.com> wrote: > > On Tue, Nov 25, 2025, syzbot wrote: > > syzbot has found a reproducer for the following issue on: > > > > HEAD commit: 8a2bcda5e139 Merge tag 'for-6.18/dm-fixes' of git://git.ke.. > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=1604f8b4580000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f > > dashboard link: https://syzkaller.appspot.com/bug?extid=59f2c3a3fc4f6c09b8cd > > compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ecf612580000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d9cf42580000 > > > > Downloadable assets: > > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-8a2bcda5.raw.xz > > vmlinux: https://storage.googleapis.com/syzbot-assets/fc3f96645396/vmlinux-8a2bcda5.xz > > kernel image: https://storage.googleapis.com/syzbot-assets/e20aa7be5d33/bzImage-8a2bcda5.xz > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+59f2c3a3fc4f6c09b8cd@syzkaller.appspotmail.com > > > > ------------[ cut here ]------------ > > WARNING: CPU: 0 PID: 5495 at arch/x86/kvm/lapic.c:3483 kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 > > Modules linked in: > > CPU: 0 UID: 0 PID: 5495 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) > > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 > > RIP: 0010:kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 > > Code: eb 0c e8 32 da 71 00 eb 05 e8 2b da 71 00 45 31 ff 44 89 f8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 10 da 71 00 90 <0f> 0b 90 e9 ec fd ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 4f > > RSP: 0018:ffffc90002b2fbf0 EFLAGS: 00010293 > > RAX: ffffffff814e3940 RBX: 0000000000000002 RCX: ffff88801f8ca480 > > RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 > > RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff814689b6 > > R10: dffffc0000000000 R11: ffffed1002268008 R12: 0000000000000002 > > R13: dffffc0000000000 R14: ffff888042c95c00 R15: ffff8880113402d8 > > FS: 000055558ab60500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 0000200000002000 CR3: 0000000058d0b000 CR4: 0000000000352ef0 > > Call Trace: > > <TASK> > > kvm_arch_vcpu_ioctl_get_mpstate+0x128/0x480 arch/x86/kvm/x86.c:12147 > > kvm_vcpu_ioctl+0x625/0xe90 virt/kvm/kvm_main.c:4539 > > vfs_ioctl fs/ioctl.c:51 [inline] > > __do_sys_ioctl fs/ioctl.c:597 [inline] > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > > do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 > > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > RIP: 0033:0x7f918bd8f749 > > Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 > > RSP: 002b:00007ffc74a3c2a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > > RAX: ffffffffffffffda RBX: 00007f918bfe5fa0 RCX: 00007f918bd8f749 > > RDX: 0000000000000000 RSI: 000000008004ae98 RDI: 0000000000000005 > > RBP: 00007f918be13f91 R08: 0000000000000000 R09: 0000000000000000 > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > > R13: 00007f918bfe5fa0 R14: 00007f918bfe5fa0 R15: 0000000000000003 > > </TASK> > > Syzbot outsmarted me once again. I thought I had made this impossible in commit > 0fe3e8d804fd ("KVM: x86: Move INIT_RECEIVED vs. INIT/SIPI blocked check to KVM_RUN"), > but now syzkaller is triggering the WARN by swapping the order and stuffing VMXON > after INIT (ignore the EINVAL, KVM gets through enter_vmx_operation() before detecting > bad guest state). > > ioctl(5, KVM_SET_MP_STATE, 0x200000000000) = 0 > ioctl(5, KVM_SET_NESTED_STATE, 0x200000000a80) = -1 EINVAL (Invalid argument) > ioctl(5, KVM_GET_MP_STATE, 0) = -1 EFAULT (Bad address) > > At this point, I'm leaning strongly towards dropping the WARN as it's not helping, > and userspace doing odd things is completely uninteresting. > > diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c > index 7b1b8f450f4c..df2a69da11b7 100644 > --- a/arch/x86/kvm/lapic.c > +++ b/arch/x86/kvm/lapic.c > @@ -3521,7 +3521,6 @@ int kvm_apic_accept_events(struct kvm_vcpu *vcpu) > * wait-for-SIPI (WFS). > */ > if (!kvm_apic_init_sipi_allowed(vcpu)) { > - WARN_ON_ONCE(vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED); > clear_bit(KVM_APIC_SIPI, &apic->pending_events); > return 0; > } Hi Sean, this is still biting us. Have you made up your mind on the above patch? Thanks, Alex ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [kvm-x86?] WARNING in kvm_apic_accept_events (2) 2026-01-22 16:41 ` Alexander Potapenko @ 2026-01-22 18:10 ` Sean Christopherson 0 siblings, 0 replies; 5+ messages in thread From: Sean Christopherson @ 2026-01-22 18:10 UTC (permalink / raw) To: Alexander Potapenko Cc: syzbot, bp, dave.hansen, hpa, kvm, linux-kernel, mingo, pbonzini, syzkaller-bugs, tglx, x86 On Thu, Jan 22, 2026, Alexander Potapenko wrote: > On Wed, Nov 26, 2025 at 12:10 AM 'Sean Christopherson' via > syzkaller-bugs <syzkaller-bugs@googlegroups.com> wrote: > > > > On Tue, Nov 25, 2025, syzbot wrote: > > > syzbot has found a reproducer for the following issue on: > > > > > > HEAD commit: 8a2bcda5e139 Merge tag 'for-6.18/dm-fixes' of git://git.ke.. > > > git tree: upstream > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1604f8b4580000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=a1db0fea040c2a9f > > > dashboard link: https://syzkaller.appspot.com/bug?extid=59f2c3a3fc4f6c09b8cd > > > compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ecf612580000 > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d9cf42580000 > > > > > > Downloadable assets: > > > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-8a2bcda5.raw.xz > > > vmlinux: https://storage.googleapis.com/syzbot-assets/fc3f96645396/vmlinux-8a2bcda5.xz > > > kernel image: https://storage.googleapis.com/syzbot-assets/e20aa7be5d33/bzImage-8a2bcda5.xz > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > Reported-by: syzbot+59f2c3a3fc4f6c09b8cd@syzkaller.appspotmail.com > > > > > > ------------[ cut here ]------------ > > > WARNING: CPU: 0 PID: 5495 at arch/x86/kvm/lapic.c:3483 kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 > > > Modules linked in: > > > CPU: 0 UID: 0 PID: 5495 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) > > > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 > > > RIP: 0010:kvm_apic_accept_events+0x341/0x490 arch/x86/kvm/lapic.c:3483 > > > Code: eb 0c e8 32 da 71 00 eb 05 e8 2b da 71 00 45 31 ff 44 89 f8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 10 da 71 00 90 <0f> 0b 90 e9 ec fd ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 4f > > > RSP: 0018:ffffc90002b2fbf0 EFLAGS: 00010293 > > > RAX: ffffffff814e3940 RBX: 0000000000000002 RCX: ffff88801f8ca480 > > > RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 > > > RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff814689b6 > > > R10: dffffc0000000000 R11: ffffed1002268008 R12: 0000000000000002 > > > R13: dffffc0000000000 R14: ffff888042c95c00 R15: ffff8880113402d8 > > > FS: 000055558ab60500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000 > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > > CR2: 0000200000002000 CR3: 0000000058d0b000 CR4: 0000000000352ef0 > > > Call Trace: > > > <TASK> > > > kvm_arch_vcpu_ioctl_get_mpstate+0x128/0x480 arch/x86/kvm/x86.c:12147 > > > kvm_vcpu_ioctl+0x625/0xe90 virt/kvm/kvm_main.c:4539 > > > vfs_ioctl fs/ioctl.c:51 [inline] > > > __do_sys_ioctl fs/ioctl.c:597 [inline] > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > > > do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > > RIP: 0033:0x7f918bd8f749 > > > Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 > > > RSP: 002b:00007ffc74a3c2a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > > > RAX: ffffffffffffffda RBX: 00007f918bfe5fa0 RCX: 00007f918bd8f749 > > > RDX: 0000000000000000 RSI: 000000008004ae98 RDI: 0000000000000005 > > > RBP: 00007f918be13f91 R08: 0000000000000000 R09: 0000000000000000 > > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > > > R13: 00007f918bfe5fa0 R14: 00007f918bfe5fa0 R15: 0000000000000003 > > > </TASK> > > > > Syzbot outsmarted me once again. I thought I had made this impossible in commit > > 0fe3e8d804fd ("KVM: x86: Move INIT_RECEIVED vs. INIT/SIPI blocked check to KVM_RUN"), > > but now syzkaller is triggering the WARN by swapping the order and stuffing VMXON > > after INIT (ignore the EINVAL, KVM gets through enter_vmx_operation() before detecting > > bad guest state). > > > > ioctl(5, KVM_SET_MP_STATE, 0x200000000000) = 0 > > ioctl(5, KVM_SET_NESTED_STATE, 0x200000000a80) = -1 EINVAL (Invalid argument) > > ioctl(5, KVM_GET_MP_STATE, 0) = -1 EFAULT (Bad address) > > > > At this point, I'm leaning strongly towards dropping the WARN as it's not helping, > > and userspace doing odd things is completely uninteresting. > > > > diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c > > index 7b1b8f450f4c..df2a69da11b7 100644 > > --- a/arch/x86/kvm/lapic.c > > +++ b/arch/x86/kvm/lapic.c > > @@ -3521,7 +3521,6 @@ int kvm_apic_accept_events(struct kvm_vcpu *vcpu) > > * wait-for-SIPI (WFS). > > */ > > if (!kvm_apic_init_sipi_allowed(vcpu)) { > > - WARN_ON_ONCE(vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED); > > clear_bit(KVM_APIC_SIPI, &apic->pending_events); > > return 0; > > } > > Hi Sean, this is still biting us. > Have you made up your mind on the above patch? I'll properly post and apply the above. I have some ideas on how to preserve the basic gist of the sanity checks, though I hope I wrote them down somewhere, because I can't remember what they were... ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-01-22 18:11 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-11-25 16:32 [syzbot] [kvm-x86?] WARNING in kvm_apic_accept_events (2) syzbot 2025-11-25 20:29 ` syzbot 2025-11-25 23:09 ` Sean Christopherson 2026-01-22 16:41 ` Alexander Potapenko 2026-01-22 18:10 ` Sean Christopherson
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox