From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754379AbcKLGyi (ORCPT <rfc822;w@1wt.eu>);
        Sat, 12 Nov 2016 01:54:38 -0500
Received: from mail-qt0-f171.google.com ([209.85.216.171]:32980 "EHLO
        mail-qt0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751643AbcKLGyh (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Sat, 12 Nov 2016 01:54:37 -0500
MIME-Version: 1.0
From: Dmitry Vyukov <dvyukov@google.com>
Date: Fri, 11 Nov 2016 22:54:15 -0800
Message-ID: <CACT4Y+Y++5tdoL0C-Oqk=+dSz2tUEe_5fEq2OZJGXv9O6cHs3g@mail.gmail.com>
Subject: kvm: suspicious RCU usage/missed lock in kvm_lapic_set_vapic_addr
To: Paolo Bonzini <pbonzini@redhat.com>, rkrcmar@redhat.com,
        Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@redhat.com>,
        "H. Peter Anvin" <hpa@zytor.com>, "x86@kernel.org" <x86@kernel.org>,
        KVM list <kvm@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>,
        Steve Rutherford <srutherford@google.com>
Cc: syzkaller <syzkaller@googlegroups.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hello,

I've got the following warning while running syzkaller fuzzer:


[ INFO: suspicious RCU usage. ]
4.9.0-rc4+ #47 Not tainted
-------------------------------
./include/linux/kvm_host.h:536 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by syz-executor/6679:
 #0: [   67.230820]  (

stack backtrace:
CPU: 1 PID: 6679 Comm: syz-executor Not tainted 4.9.0-rc4+ #47
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffff880039e2f6d0 ffffffff81c2e46b ffff88003e3a5b40 0000000000000000
 0000000000000001 ffffffff83215600 ffff880039e2f700 ffffffff81334ea9
 ffffc9000730b000 0000000000000004 ffff88003c4f8420 ffff88003d3f8000
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff81c2e46b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
 [<ffffffff81334ea9>] lockdep_rcu_suspicious+0x139/0x180
kernel/locking/lockdep.c:4445
 [<     inline     >] __kvm_memslots include/linux/kvm_host.h:534
 [<     inline     >] kvm_memslots include/linux/kvm_host.h:541
 [<ffffffff8105d6ae>] kvm_gfn_to_hva_cache_init+0xa1e/0xce0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:1941
 [<ffffffff8112685d>] kvm_lapic_set_vapic_addr+0xed/0x140
arch/x86/kvm/lapic.c:2217
 [<ffffffff810a6ca4>] kvm_arch_vcpu_ioctl+0x224/0x3100 arch/x86/kvm/x86.c:3425
 [<ffffffff810604e2>] kvm_vcpu_ioctl+0x1e2/0xdd0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2708
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff816b03cc>] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679
 [<     inline     >] SYSC_ioctl fs/ioctl.c:694
 [<ffffffff816b130f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff831f0dc1>] entry_SYSCALL_64_fastpath+0x1f/0xc2


__kvm_memslots requires a lock to be held, but it is not held:

static inline struct kvm_memslots *__kvm_memslots(struct kvm *kvm, int as_id)
{
  return rcu_dereference_check(kvm->memslots[as_id],
    srcu_read_lock_held(&kvm->srcu)
    || lockdep_is_held(&kvm->slots_lock));
}

On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).