All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sean Christopherson <seanjc@google.com>
To: syzbot <syzbot+81227d2bd69e9dedb802@syzkaller.appspotmail.com>
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
	pbonzini@redhat.com, syzkaller-bugs@googlegroups.com,
	"Muhammad Usama Anjum" <usama.anjum@collabora.com>,
	"Michał Mirosław" <mirq-linux@rere.qmqm.pl>,
	"Arnd Bergmann" <arnd@arndb.de>,
	"Stephen Rothwell" <sfr@canb.auug.org.au>,
	"Andrew Morton" <akpm@linux-foundation.org>,
	"Andrei Vagin" <avagin@gmail.com>
Subject: Re: [syzbot] [kvm?] WARNING in kvm_mmu_notifier_change_pte
Date: Fri, 5 Jan 2024 11:06:15 -0800	[thread overview]
Message-ID: <ZZhTJ899Hzv8zuzX@google.com> (raw)
In-Reply-To: <000000000000f6d051060c6785bc@google.com>

+PAGEMAP_SCAN folks

On Wed, Dec 13, 2023, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    f2e8a57ee903 Merge tag 'scsi-fixes' of git://git.kernel.or..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14fdc732e80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=e56083f7dbe162c2
> dashboard link: https://syzkaller.appspot.com/bug?extid=81227d2bd69e9dedb802
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=129d09cae80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10b8afeee80000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/7b75e59fc59d/disk-f2e8a57e.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/f853580d61be/vmlinux-f2e8a57e.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/8c893ce02e2c/bzImage-f2e8a57e.xz
> 
> Bisection is inconclusive: the first bad commit could be any of:
> 
> d61ea1cb0095 userfaultfd: UFFD_FEATURE_WP_ASYNC
> 52526ca7fdb9 fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs

PAGEMAP_SCAN is indeed to blame, do_pagemap_scan() invokes mmu_notifiers without
holding mmap_lock.  This allows KVM to attach its mmu_notifier between start()
and end(), which causes mn_active_invalidate_count to underflow.  Note, the actual
WARN from KVM fires after the underflow; I'll send a patch to further harden KVM.

Ideally this would be fixed before the final v6.7 release, as it would be trivial
for this to cause deadlock in KVM.  The only reason the repro doesn't cause
deadlock is because it's not creating memslots in KVM, i.e. KVM doesn't truly
consume the corrupted mn_active_invalidate_count.

Side topic, it would be wonderful if we could figure out a semi-efficient way to
add lockdep assertions in the mmu_notifier helpers to assert that at least one of
the locks acquired by mm_take_all_locks() is held.  Relying on KVM's paranoia to
detect these types of bugs is not a good strategy.

  reply	other threads:[~2024-01-05 19:06 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-12-13 17:30 [syzbot] [kvm?] WARNING in kvm_mmu_notifier_change_pte syzbot
2024-01-05 19:06 ` Sean Christopherson [this message]
2024-02-09 21:07 ` Sean Christopherson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZZhTJ899Hzv8zuzX@google.com \
    --to=seanjc@google.com \
    --cc=akpm@linux-foundation.org \
    --cc=arnd@arndb.de \
    --cc=avagin@gmail.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mirq-linux@rere.qmqm.pl \
    --cc=pbonzini@redhat.com \
    --cc=sfr@canb.auug.org.au \
    --cc=syzbot+81227d2bd69e9dedb802@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=usama.anjum@collabora.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.