* [syzbot ci] Re: KVM: Fix+harden against bad uaccess using dying VM [not found] <20261027221209.1560865-1-seanjc@google.com> @ 2026-10-28 9:18 ` syzbot ci 0 siblings, 0 replies; 3+ messages in thread From: syzbot ci @ 2026-10-28 9:18 UTC (permalink / raw) To: jmattson, jthoughton, kvm, linux-kernel, linuxppc-dev, maddy, mason, npiggin, pbonzini, seanjc Cc: syzbot, syzkaller-bugs syzbot ci has tested the following series [v3] KVM: Fix+harden against bad uaccess using dying VM https://lore.kernel.org/all/20261027221209.1560865-1-seanjc@google.com * [PATCH v3 01/15] KVM: Reject user accesses to guest memory if current->mm != kvm->mm * [PATCH v3 02/15] KVM: nVMX: Don't force a full nested VM-Exit when destroying a vCPU * [PATCH v3 03/15] KVM: PPC: Flush/zap all memslots on kvm_arch_flush_shadow_all() * [PATCH v3 04/15] KVM: x86: Unmap VMAs for KVM-internal memslots when the memslot is freed * [PATCH v3 05/15] KVM: Disallow setting memslots when the VM is being destroyed * [PATCH v3 06/15] KVM: Destroy memslots immediately after mmu_notifiers are unregistered * [PATCH v3 07/15] KVM: WARN if KVM attempts to do guest-related uaccess with "wrong" process * [PATCH v3 08/15] KVM: WARN and reject guest-based uaccess if VM is dying * [PATCH v3 09/15] KVM: Pre-check uaccesses in KVM's APIs to read/write guest memory * [PATCH v3 10/15] KVM: VMX: Explicility free vmcs01, not the current VMCS, in vCPU free paths * [PATCH v3 11/15] KVM: nVMX: Don't explicitly VMCLEAR+free() vmcs01's shadow VMCS when freeing vCPU * [PATCH v3 12/15] KVM: nVMX: Cancel the nested VMX Preemption Timer's hrtimer in free_nested() * [PATCH v3 13/15] KVM: VMX: Explicitly remove dying vCPUs from the PI wakeup list * [PATCH v3 14/15] KVM: nVMX: Don't switch to vmcs01 when freeing a vCPU * [PATCH v3 15/15] KVM: nVMX: Don't load+put the vCPU when freeing nested state for a dying vCPU and found the following issue: WARNING in vt_vcpu_pi_remove_from_wakeup_list Full report is available here: https://ci.syzbot.org/series/c648fc23-f4c2-4346-93cd-b717ef38b27c *** WARNING in vt_vcpu_pi_remove_from_wakeup_list tree: kvm-next URL: https://kernel.googlesource.com/pub/scm/virt/kvm/kvm/ base: 7e60162b16f9da0d2fa83da5c1723b6853a0ac1d arch: amd64 compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 config: https://ci.syzbot.org/builds/e4ed6c4f-9b58-4549-9ac6-525add47e472/config syz repro: https://ci.syzbot.org/findings/320f356a-c5e9-41ff-b8f5-3f0866e300b7/syz_repro ------------[ cut here ]------------ refcount_read(&vcpu->kvm->users_count) WARNING: arch/x86/kvm/vmx/posted_intr.c:154 at vt_vcpu_pi_remove_from_wakeup_list+0x142/0x1f0 arch/x86/kvm/vmx/posted_intr.c:154, CPU#1: syz.2.19/5870 Modules linked in: CPU: 1 UID: 0 PID: 5870 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:vt_vcpu_pi_remove_from_wakeup_list+0x142/0x1f0 arch/x86/kvm/vmx/posted_intr.c:154 Code: 48 85 db 74 2d e8 ee 1b 64 00 eb 0c e8 e7 1b 64 00 eb 05 e8 e0 1b 64 00 5b 41 5e 41 5f 5d e9 c5 b5 87 0a cc e8 cf 1b 64 00 90 <0f> 0b 90 e9 2b ff ff ff e8 c1 1b 64 00 e8 ac 60 cf ff eb da 44 89 RSP: 0018:ffffc900037cf8c8 EFLAGS: 00010293 RAX: ffffffff816404a1 RBX: ffff88816ada8000 RCX: ffff888110eb0000 RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000 RBP: 0000000000000003 R08: ffff88810fb01f83 R09: 1ffff11021f603f0 R10: dffffc0000000000 R11: ffffed1021f603f1 R12: dffffc0000000000 R13: 00000000fffffff8 R14: ffff88810fb01f80 R15: dffffc0000000000 FS: 00007f9e487ab6c0(0000) GS:ffff8882a7cbf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f07a7ed4870 CR3: 000000010eea9000 CR4: 0000000000352ef0 Call Trace: <TASK> vmx_vcpu_free+0x28/0x400 arch/x86/kvm/vmx/vmx.c:7517 kvm_arch_vcpu_destroy+0x154/0x380 arch/x86/kvm/x86.c:9556 kvm_vm_ioctl_create_vcpu+0x76f/0x9f0 virt/kvm/kvm_main.c:4384 kvm_vm_ioctl+0x442/0xcb0 virt/kvm/kvm_main.c:5294 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9e4799f1eb Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007f9e487aaed0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f9e4799f1eb RDX: 0000000000000003 RSI: 000000000000ae41 RDI: 0000000000000085 RBP: 00007f9e47a36b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000200000c00000 R11: 0000000000000246 R12: 00000000000004ce R13: 0000200000c00000 R14: 0000200000001040 R15: 00007ffeb7342be8 </TASK> *** If these findings have caused you to resend the series or submit a separate fix, please add the following tag to your commit message: Tested-by: syzbot@syzkaller.appspotmail.com --- This report is generated by a bot. It may contain errors. syzbot ci engineers can be reached at syzkaller@googlegroups.com. To test a fix for this bug, please reply with `#syz test` (on a separate line) and attach the patch to the email. Notes: - The patch will be applied on top of the tested series (as an incremental fix). - To test a new version of the whole series, please send it directly to syzbot@lists.linux.dev. - Arguments like custom git repos and branches are not supported. ^ permalink raw reply [flat|nested] 3+ messages in thread
[parent not found: <20261001202234.3794060-1-seanjc@google.com>]
* [syzbot ci] Re: KVM: Fix+harden against bad uaccess using dying VM [not found] <20261001202234.3794060-1-seanjc@google.com> @ 2026-10-02 20:30 ` syzbot ci 2026-10-02 20:39 ` Sean Christopherson 0 siblings, 1 reply; 3+ messages in thread From: syzbot ci @ 2026-10-02 20:30 UTC (permalink / raw) To: jmattson, kvm, linux-kernel, linuxppc-dev, maddy, npiggin, pbonzini, seanjc Cc: syzbot, syzkaller-bugs syzbot ci has tested the following series [v2] KVM: Fix+harden against bad uaccess using dying VM https://lore.kernel.org/all/20261001202234.3794060-1-seanjc@google.com * [PATCH v2 01/10] KVM: Reject user accesses to guest memory if current->mm != kvm->mm * [PATCH v2 02/10] KVM: PPC: Flush/zap all memslots on kvm_arch_flush_shadow_all() * [PATCH v2 03/10] KVM: x86: Unmap VMAs for KVM-internal memslots when the memslot is freed * [PATCH v2 04/10] KVM: Disallow setting memslots when the VM is being destroyed * [PATCH v2 05/10] KVM: Destroy memslots immediately after mmu_notifiers are unregistered * [PATCH v2 06/10] KVM: WARN if KVM attempts to do guest-related uaccess with "wrong" process * [PATCH v2 07/10] KVM: WARN and reject guest-based uaccess if VM is dying * [PATCH v2 08/10] KVM: nVMX: Don't flush shadow VMCS12 to guest memory during vCPU teardown * [PATCH v2 09/10] KVM: nVMX: Don't try to load eVMCS12 page when the VM is dying * [PATCH v2 10/10] KVM: Pre-check uaccesses in KVM's APIs to read/write guest memory and found the following issue: WARNING in __kvm_read_guest_page Full report is available here: https://ci.syzbot.org/series/5f8da53a-c584-4176-abcb-7a29eb02e4c4 *** WARNING in __kvm_read_guest_page tree: kvm-next URL: https://kernel.googlesource.com/pub/scm/virt/kvm/kvm/ base: d4b7fb647204f0c81dfeae2d1a708e4d858e0c94 arch: amd64 compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 config: https://ci.syzbot.org/builds/4d4c10d0-f56c-448f-8782-ad4dab8f46d0/config syz repro: https://ci.syzbot.org/findings/dc5f6c42-c3ab-41b0-9384-1a15798e4820/syz_repro ------------[ cut here ]------------ !__kvm_can_do_uaccess(kvm) WARNING: ./include/linux/kvm_host.h:1360 at kvm_can_do_uaccess include/linux/kvm_host.h:1360 [inline], CPU#1: syz.1.18/5858 WARNING: ./include/linux/kvm_host.h:1360 at kvm_is_guest_access_ok virt/kvm/kvm_main.c:3216 [inline], CPU#1: syz.1.18/5858 WARNING: ./include/linux/kvm_host.h:1360 at __kvm_read_guest_page+0x38e/0x440 virt/kvm/kvm_main.c:3226, CPU#1: syz.1.18/5858 Modules linked in: CPU: 1 UID: 0 PID: 5858 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:kvm_can_do_uaccess include/linux/kvm_host.h:1360 [inline] RIP: 0010:kvm_is_guest_access_ok virt/kvm/kvm_main.c:3216 [inline] RIP: 0010:__kvm_read_guest_page+0x38e/0x440 virt/kvm/kvm_main.c:3226 Code: f2 ff ff ff 0f 44 d8 31 ff e8 5e a4 89 00 89 d8 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 09 ac a8 0a cc e8 83 9e 89 00 90 <0f> 0b 90 bb f2 ff ff ff eb da e8 73 9e 89 00 90 0f 0b 90 bb f2 ff RSP: 0018:ffffc90003157778 EFLAGS: 00010293 RAX: ffffffff813e2d22 RBX: 0000000000000000 RCX: ffff888174382580 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 1ffff1102217d82a R08: ffff888110bee183 R09: 1ffff1102217dc30 R10: dffffc0000000000 R11: ffffed102217dc31 R12: ffff888110bee180 R13: ffff888174382b40 R14: 1ffff1102217dc30 R15: 0000000000000000 FS: 000055557c0db500(0000) GS:ffff8882a8cda000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f458dfeb840 CR3: 000000016c9d0000 CR4: 0000000000352ef0 Call Trace: <TASK> kvm_vcpu_read_guest+0x64/0x140 virt/kvm/kvm_main.c:3284 nested_vmx_load_msr+0x133/0x4d0 arch/x86/kvm/vmx/nested.c:1107 load_vmcs12_host_state+0x10ca/0x1e20 arch/x86/kvm/vmx/nested.c:4930 __nested_vmx_vmexit+0x1800/0x2d10 arch/x86/kvm/vmx/nested.c:5206 nested_vmx_vmexit arch/x86/kvm/vmx/nested.h:46 [inline] vmx_leave_nested arch/x86/kvm/vmx/nested.c:6891 [inline] nested_vmx_free_vcpu+0x8e/0xd0 arch/x86/kvm/vmx/nested.c:389 vmx_vcpu_free+0x109/0x3e0 arch/x86/kvm/vmx/vmx.c:7653 kvm_arch_vcpu_destroy+0x154/0x380 arch/x86/kvm/x86.c:9463 kvm_vcpu_destroy virt/kvm/kvm_main.c:469 [inline] kvm_destroy_vcpus+0x123/0x380 virt/kvm/kvm_main.c:489 kvm_arch_destroy_vm+0x55/0x120 arch/x86/kvm/x86.c:10014 kvm_destroy_vm virt/kvm/kvm_main.c:1326 [inline] kvm_put_kvm+0x93a/0xc80 virt/kvm/kvm_main.c:1359 kvm_vm_release+0x43/0x50 virt/kvm/kvm_main.c:1382 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7fec79e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff0d2850c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f7feca27da0 RCX: 00007f7fec79e159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f7feca27da0 R08: 00007f7feca26038 R09: 0000000000000000 R10: 000000000003fdb8 R11: 0000000000000246 R12: 000000000000ec04 R13: 00007f7feca25fac R14: 000000000000e938 R15: 00007fff0d2851d0 </TASK> *** If these findings have caused you to resend the series or submit a separate fix, please add the following tag to your commit message: Tested-by: syzbot@syzkaller.appspotmail.com --- This report is generated by a bot. It may contain errors. syzbot ci engineers can be reached at syzkaller@googlegroups.com. To test a fix for this bug, please reply with `#syz test` (on a separate line) and attach the patch to the email. Notes: - The patch will be applied on top of the tested series (as an incremental fix). - To test a new version of the whole series, please send it directly to syzbot@lists.linux.dev. - Arguments like custom git repos and branches are not supported. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot ci] Re: KVM: Fix+harden against bad uaccess using dying VM 2026-10-02 20:30 ` syzbot ci @ 2026-10-02 20:39 ` Sean Christopherson 0 siblings, 0 replies; 3+ messages in thread From: Sean Christopherson @ 2026-10-02 20:39 UTC (permalink / raw) To: syzbot ci Cc: jmattson, kvm, linux-kernel, linuxppc-dev, maddy, npiggin, pbonzini, syzbot, syzkaller-bugs On Fri, Oct 02, 2026, syzbot ci wrote: > ------------[ cut here ]------------ > !__kvm_can_do_uaccess(kvm) > WARNING: ./include/linux/kvm_host.h:1360 at kvm_can_do_uaccess include/linux/kvm_host.h:1360 [inline], CPU#1: syz.1.18/5858 > WARNING: ./include/linux/kvm_host.h:1360 at kvm_is_guest_access_ok virt/kvm/kvm_main.c:3216 [inline], CPU#1: syz.1.18/5858 > WARNING: ./include/linux/kvm_host.h:1360 at __kvm_read_guest_page+0x38e/0x440 virt/kvm/kvm_main.c:3226, CPU#1: syz.1.18/5858 > Modules linked in: > CPU: 1 UID: 0 PID: 5858 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 > RIP: 0010:kvm_can_do_uaccess include/linux/kvm_host.h:1360 [inline] > RIP: 0010:kvm_is_guest_access_ok virt/kvm/kvm_main.c:3216 [inline] > RIP: 0010:__kvm_read_guest_page+0x38e/0x440 virt/kvm/kvm_main.c:3226 > Code: f2 ff ff ff 0f 44 d8 31 ff e8 5e a4 89 00 89 d8 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 09 ac a8 0a cc e8 83 9e 89 00 90 <0f> 0b 90 bb f2 ff ff ff eb da e8 73 9e 89 00 90 0f 0b 90 bb f2 ff > RSP: 0018:ffffc90003157778 EFLAGS: 00010293 > RAX: ffffffff813e2d22 RBX: 0000000000000000 RCX: ffff888174382580 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: 1ffff1102217d82a R08: ffff888110bee183 R09: 1ffff1102217dc30 > R10: dffffc0000000000 R11: ffffed102217dc31 R12: ffff888110bee180 > R13: ffff888174382b40 R14: 1ffff1102217dc30 R15: 0000000000000000 > FS: 000055557c0db500(0000) GS:ffff8882a8cda000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f458dfeb840 CR3: 000000016c9d0000 CR4: 0000000000352ef0 > Call Trace: > <TASK> > kvm_vcpu_read_guest+0x64/0x140 virt/kvm/kvm_main.c:3284 > nested_vmx_load_msr+0x133/0x4d0 arch/x86/kvm/vmx/nested.c:1107 Oh man. vmx_leave_nested() is so broken. If loading MSRs on nested VM-Exit is broken (and it obviously is), then storing MSRs on nested VM-Exit is also broken, i.e. there's at least a second case where nVMX can write to random process memory on vCPU teardown (shadow vmcs12 being the other one). It probably makes sense to go straight to open coding punting the vCPU out of L2 in vmx_leave_nested() instead of hack-a-fixing a bunch of flows. I.e. replace patch 8 and 9 with a proper fix. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-28 9:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20261027221209.1560865-1-seanjc@google.com>
2026-10-28 9:18 ` [syzbot ci] Re: KVM: Fix+harden against bad uaccess using dying VM syzbot ci
[not found] <20261001202234.3794060-1-seanjc@google.com>
2026-10-02 20:30 ` syzbot ci
2026-10-02 20:39 ` Sean Christopherson
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox