* kvm: GPF in native_write_cr4 @ 2017-10-31 9:59 Dmitry Vyukov 2017-10-31 10:05 ` Wanpeng Li 2017-10-31 11:10 ` Wanpeng Li 0 siblings, 2 replies; 8+ messages in thread From: Dmitry Vyukov @ 2017-10-31 9:59 UTC (permalink / raw) To: Paolo Bonzini, Radim Krčmář, KVM list, LKML, Xiao Guangrong, Haozhong Zhang, Wanpeng Li, David Hildenbrand Cc: syzkaller Hello, I am seeing the following crash on upstream 15f859ae5c43c7f0a064ed92d33f7a5bc5de6de0 (Oct 26). Reproducer: https://gist.githubusercontent.com/dvyukov/a9690f90c39c1e3b1b6c7acda2d5ef89/raw/33e07f3d6779005fc475764e0802e4a5aee8d0cf/gistfile1.txt I run qemu with -append "kvm-intel.nested=1" -enable-kvm -cpu host. My host cpu is E5-2690. general protection fault: 0000 [#1] SMP KASAN Modules linked in: CPU: 1 PID: 3064 Comm: a.out Not tainted 4.14.0-rc6+ #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880064c203c0 task.stack: ffff880066718000 RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 RSP: 0018:ffff88006671f598 EFLAGS: 00010097 RAX: ffff880064c203c0 RBX: 00000000001606e0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 RBP: ffff88006671f598 R08: 0000000000000006 R09: 0000000000000006 R10: ffff880064c203c0 R11: 0000000000000000 R12: 0000000000000001 R13: ffff88006ca94828 R14: ffff88006ca94850 R15: ffff88006ca80000 FS: 00000000019cd880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000005a22001 CR4: 00000000001626e0 Call Trace: __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline] cr4_clear_bits arch/x86/include/asm/tlbflush.h:197 [inline] kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3571 [inline] hardware_disable+0x197/0x210 arch/x86/kvm/vmx.c:3577 kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:7920 hardware_disable_nolock+0x30/0x40 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3282 on_each_cpu+0xca/0x1b0 kernel/smp.c:604 hardware_disable_all_nolock+0x44/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3300 hardware_disable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3306 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:735 [inline] kvm_put_kvm+0x887/0xe00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 kvm_vm_release+0x42/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:759 __fput+0x301/0x7e0 fs/file_table.c:210 ____fput+0x15/0x20 fs/file_table.c:244 task_work_run+0x19e/0x250 kernel/task_work.c:112 exit_task_work include/linux/task_work.h:21 [inline] do_exit+0x99f/0x18b0 kernel/exit.c:865 do_group_exit+0x14b/0x3f0 kernel/exit.c:968 SYSC_exit_group kernel/exit.c:979 [inline] SyS_exit_group+0x1d/0x20 kernel/exit.c:977 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x443849 RSP: 002b:00007ffe58a95c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000404800 R14: 0000000000404890 R15: 0000000000000000 Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 RSP: ffff88006671f598 ---[ end trace 6f9dbcc14aa47936 ]--- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: kvm: GPF in native_write_cr4 2017-10-31 9:59 kvm: GPF in native_write_cr4 Dmitry Vyukov @ 2017-10-31 10:05 ` Wanpeng Li 2017-10-31 11:10 ` Wanpeng Li 1 sibling, 0 replies; 8+ messages in thread From: Wanpeng Li @ 2017-10-31 10:05 UTC (permalink / raw) To: Dmitry Vyukov Cc: Paolo Bonzini, Radim Krčmář, KVM list, LKML, Xiao Guangrong, Haozhong Zhang, David Hildenbrand, syzkaller 2017-10-31 17:59 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>: > Hello, > > I am seeing the following crash on upstream > 15f859ae5c43c7f0a064ed92d33f7a5bc5de6de0 (Oct 26). > Reproducer: > https://gist.githubusercontent.com/dvyukov/a9690f90c39c1e3b1b6c7acda2d5ef89/raw/33e07f3d6779005fc475764e0802e4a5aee8d0cf/gistfile1.txt > I run qemu with -append "kvm-intel.nested=1" -enable-kvm -cpu host. My > host cpu is E5-2690. > I will have a look. Regards, Wanpeng Li > general protection fault: 0000 [#1] SMP KASAN > Modules linked in: > CPU: 1 PID: 3064 Comm: a.out Not tainted 4.14.0-rc6+ #11 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > task: ffff880064c203c0 task.stack: ffff880066718000 > RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 > RSP: 0018:ffff88006671f598 EFLAGS: 00010097 > RAX: ffff880064c203c0 RBX: 00000000001606e0 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 > RBP: ffff88006671f598 R08: 0000000000000006 R09: 0000000000000006 > R10: ffff880064c203c0 R11: 0000000000000000 R12: 0000000000000001 > R13: ffff88006ca94828 R14: ffff88006ca94850 R15: ffff88006ca80000 > FS: 00000000019cd880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000000 CR3: 0000000005a22001 CR4: 00000000001626e0 > Call Trace: > __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline] > cr4_clear_bits arch/x86/include/asm/tlbflush.h:197 [inline] > kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3571 [inline] > hardware_disable+0x197/0x210 arch/x86/kvm/vmx.c:3577 > kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:7920 > hardware_disable_nolock+0x30/0x40 > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3282 > on_each_cpu+0xca/0x1b0 kernel/smp.c:604 > hardware_disable_all_nolock+0x44/0x60 > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3300 > hardware_disable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3306 [inline] > kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:735 [inline] > kvm_put_kvm+0x887/0xe00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 > kvm_vm_release+0x42/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:759 > __fput+0x301/0x7e0 fs/file_table.c:210 > ____fput+0x15/0x20 fs/file_table.c:244 > task_work_run+0x19e/0x250 kernel/task_work.c:112 > exit_task_work include/linux/task_work.h:21 [inline] > do_exit+0x99f/0x18b0 kernel/exit.c:865 > do_group_exit+0x14b/0x3f0 kernel/exit.c:968 > SYSC_exit_group kernel/exit.c:979 [inline] > SyS_exit_group+0x1d/0x20 kernel/exit.c:977 > entry_SYSCALL_64_fastpath+0x1f/0xbe > RIP: 0033:0x443849 > RSP: 002b:00007ffe58a95c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 > R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 > R13: 0000000000404800 R14: 0000000000404890 R15: 0000000000000000 > Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 > 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> > 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d > RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 > RSP: ffff88006671f598 > ---[ end trace 6f9dbcc14aa47936 ]--- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: kvm: GPF in native_write_cr4 2017-10-31 9:59 kvm: GPF in native_write_cr4 Dmitry Vyukov 2017-10-31 10:05 ` Wanpeng Li @ 2017-10-31 11:10 ` Wanpeng Li 2017-10-31 11:24 ` Dmitry Vyukov 2017-10-31 12:53 ` Haozhong Zhang 1 sibling, 2 replies; 8+ messages in thread From: Wanpeng Li @ 2017-10-31 11:10 UTC (permalink / raw) To: Dmitry Vyukov Cc: Paolo Bonzini, Radim Krčmář, KVM list, LKML, Xiao Guangrong, Haozhong Zhang, David Hildenbrand, syzkaller 2017-10-31 17:59 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>: > Hello, > > I am seeing the following crash on upstream > 15f859ae5c43c7f0a064ed92d33f7a5bc5de6de0 (Oct 26). > Reproducer: > https://gist.githubusercontent.com/dvyukov/a9690f90c39c1e3b1b6c7acda2d5ef89/raw/33e07f3d6779005fc475764e0802e4a5aee8d0cf/gistfile1.txt > I run qemu with -append "kvm-intel.nested=1" -enable-kvm -cpu host. My > host cpu is E5-2690. > I can't reproduce this w/ latest kvm/queue in both L0 and L1. In addition, there is a commit tries to fix cr4 recently. https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=8eb3f87d903168bdbd1222776a6b1e281f50513e The testcast is complex, if the below strace log is as you expected? execve("./a.out", ["./a.out"], [/* 32 vars */]) = 0 uname({sysname="Linux", nodename="kernel", ...}) = 0 brk(NULL) = 0x1d42000 brk(0x1d431c0) = 0x1d431c0 arch_prctl(ARCH_SET_FS, 0x1d42880) = 0 readlink("/proc/self/exe", "/home/kernel/a.out", 4096) = 18 brk(0x1d641c0) = 0x1d641c0 brk(0x1d65000) = 0x1d65000 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) mmap(0x20000000, 11481088, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 openat(AT_FDCWD, "/dev/kvm", O_WRONLY) = 3 ioctl(3, KVM_CREATE_VM or LOGGER_GET_LOG_BUF_SIZE, 0) = 4 ioctl(4, KVM_CREATE_VCPU, 0) = 5 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1170) = 0 ioctl(5, KVM_GET_SREGS, 0x7fff5e6c1330) = 0 open("/dev/kvm", O_RDWR) = 6 ioctl(6, KVM_GET_SUPPORTED_CPUID, 0x7fff5e6c1470) = 0 ioctl(5, KVM_SET_CPUID2, 0x7fff5e6c1470) = 0 close(6) = 0 ioctl(5, KVM_SET_MSRS, 0x7fff5e6c0c30) = 5 ioctl(5, KVM_SET_SREGS, 0x7fff5e6c1330) = 0 ioctl(5, KVM_SET_REGS, 0x7fff5e6c1230) = 0 mremap(0x20998000, 4096, 16384, MREMAP_MAYMOVE|MREMAP_FIXED, 0x200fa000) = 0x200fa000 ioctl(5, KVM_RUN, 0) = 0 mbind(0x20000000, 8192, MPOL_DEFAULT 0x20001ff8, 2, MPOL_MF_MOVE) = 0 exit_group(0) = ? +++ exited with 0 +++ i Regards, Wanpeng Li > general protection fault: 0000 [#1] SMP KASAN > Modules linked in: > CPU: 1 PID: 3064 Comm: a.out Not tainted 4.14.0-rc6+ #11 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > task: ffff880064c203c0 task.stack: ffff880066718000 > RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 > RSP: 0018:ffff88006671f598 EFLAGS: 00010097 > RAX: ffff880064c203c0 RBX: 00000000001606e0 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 > RBP: ffff88006671f598 R08: 0000000000000006 R09: 0000000000000006 > R10: ffff880064c203c0 R11: 0000000000000000 R12: 0000000000000001 > R13: ffff88006ca94828 R14: ffff88006ca94850 R15: ffff88006ca80000 > FS: 00000000019cd880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000000 CR3: 0000000005a22001 CR4: 00000000001626e0 > Call Trace: > __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline] > cr4_clear_bits arch/x86/include/asm/tlbflush.h:197 [inline] > kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3571 [inline] > hardware_disable+0x197/0x210 arch/x86/kvm/vmx.c:3577 > kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:7920 > hardware_disable_nolock+0x30/0x40 > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3282 > on_each_cpu+0xca/0x1b0 kernel/smp.c:604 > hardware_disable_all_nolock+0x44/0x60 > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3300 > hardware_disable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3306 [inline] > kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:735 [inline] > kvm_put_kvm+0x887/0xe00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 > kvm_vm_release+0x42/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:759 > __fput+0x301/0x7e0 fs/file_table.c:210 > ____fput+0x15/0x20 fs/file_table.c:244 > task_work_run+0x19e/0x250 kernel/task_work.c:112 > exit_task_work include/linux/task_work.h:21 [inline] > do_exit+0x99f/0x18b0 kernel/exit.c:865 > do_group_exit+0x14b/0x3f0 kernel/exit.c:968 > SYSC_exit_group kernel/exit.c:979 [inline] > SyS_exit_group+0x1d/0x20 kernel/exit.c:977 > entry_SYSCALL_64_fastpath+0x1f/0xbe > RIP: 0033:0x443849 > RSP: 002b:00007ffe58a95c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 > R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 > R13: 0000000000404800 R14: 0000000000404890 R15: 0000000000000000 > Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 > 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> > 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d > RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 > RSP: ffff88006671f598 > ---[ end trace 6f9dbcc14aa47936 ]--- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: kvm: GPF in native_write_cr4 2017-10-31 11:10 ` Wanpeng Li @ 2017-10-31 11:24 ` Dmitry Vyukov 2017-10-31 11:25 ` Dmitry Vyukov 2017-10-31 12:53 ` Haozhong Zhang 1 sibling, 1 reply; 8+ messages in thread From: Dmitry Vyukov @ 2017-10-31 11:24 UTC (permalink / raw) To: Wanpeng Li Cc: Paolo Bonzini, Radim Krčmář, KVM list, LKML, Xiao Guangrong, Haozhong Zhang, David Hildenbrand, syzkaller On Tue, Oct 31, 2017 at 2:10 PM, Wanpeng Li <kernellwp@gmail.com> wrote: > 2017-10-31 17:59 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>: >> Hello, >> >> I am seeing the following crash on upstream >> 15f859ae5c43c7f0a064ed92d33f7a5bc5de6de0 (Oct 26). >> Reproducer: >> https://gist.githubusercontent.com/dvyukov/a9690f90c39c1e3b1b6c7acda2d5ef89/raw/33e07f3d6779005fc475764e0802e4a5aee8d0cf/gistfile1.txt >> I run qemu with -append "kvm-intel.nested=1" -enable-kvm -cpu host. My >> host cpu is E5-2690. >> > > I can't reproduce this w/ latest kvm/queue in both L0 and L1. In > addition, there is a commit tries to fix cr4 recently. > https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=8eb3f87d903168bdbd1222776a6b1e281f50513e > The testcast is complex, if the below strace log is as you expected? I have that commit in my tree. I did a little testing and if I remove "-cpu host" from qemu command line, then crash does not happen. So my E5-2690 is somehow involved. The test case is actually for a different issues, but since recently lots of kvm-related programs trigger this bug for me. And it seems to be very easy to trigger. Here is my strace output: root@syzkaller:~# strace ./a.out execve("./a.out", ["./a.out"], [/* 11 vars */]) = 0 uname({sys="Linux", node="syzkaller", ...}) = 0 brk(0) = 0xe3c000 brk(0xe3d1c0) = 0xe3d1c0 arch_prctl(ARCH_SET_FS, 0xe3c880) = 0 readlink("/proc/self/exe", "/root/a.out", 4096) = 11 brk(0xe5e1c0) = 0xe5e1c0 brk(0xe5f000) = 0xe5f000 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) mmap(0x20000000, 11481088, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 openat(AT_FDCWD, "/dev/kvm", O_WRONLY) = 3 ioctl(3, KVM_CREATE_VM , 0) = 4 ioctl(4, KVM_CREATE_VCPU, 0) = 5 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c0630) = 0 ioctl(5, KVM_GET_SREGS, 0x7ffcf97c07f0) = 0 open("/dev/kvm", O_RDWR) = 6 ioctl(6, KVM_GET_SUPPORTED_CPUID, 0x7ffcf97c0930) = 0 ioctl(5, KVM_SET_CPUID2, 0x7ffcf97c0930) = 0 close(6) = 0 ioctl(5, KVM_SET_MSRS, 0x7ffcf97c00f0) = 5 ioctl(5, KVM_SET_SREGS, 0x7ffcf97c07f0) = 0 ioctl(5, KVM_SET_REGS, 0x7ffcf97c0760) = 0 mremap(0x20998000, 4096, 16384, MREMAP_MAYMOVE|MREMAP_FIXED, 0x200fa000) = 0x200fa000 ioctl(5, KVM_RUN, 0) = 0 mbind(0x20000000, 8192, MPOL_DEFAULT, 0x20001ff8, 2, MPOL_MF_MOVE) = 0 exit_group(0) = ? [ 44.908130] kasan: CONFIG_KASAN_INLINE enabled [ 44.909140] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 44.910615] general protection fault: 0000 [#1] SMP KASAN [ 44.911654] Modules linked in: [ 44.912241] CPU: 2 PID: 3074 Comm: a.out Not tainted 4.14.0-rc6+ #12 [ 44.913556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 44.915146] task: ffff88006a8e0740 task.stack: ffff88006bab8000 [ 44.916387] RIP: 0010:native_write_cr4+0x4/0x10 [ 44.917324] RSP: 0018:ffff88006babf458 EFLAGS: 00010097 [ 44.918373] RAX: ffff88006a8e0740 RBX: 00000000001606e0 RCX: 0000000000000000 [ 44.919693] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 [ 44.921049] RBP: ffff88006babf458 R08: ffffffff8106cf91 R09: 0000000000000000 [ 44.922417] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 [ 44.923738] R13: ffff88006cb14828 R14: ffff88006cb14850 R15: ffff88006cb00000 [ 44.925061] FS: 0000000000e3c880(0000) GS:ffff88006cb00000(0000) knlGS:0000000000000000 [ 44.926652] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.927727] CR2: 0000000000000000 CR3: 0000000005a22004 CR4: 00000000001626e0 [ 44.929067] Call Trace: [ 44.929627] hardware_disable+0x17f/0x210 [ 44.930373] ? kvm_io_bus_get_dev+0x2a0/0x2a0 [ 44.931148] kvm_arch_hardware_disable+0x35/0xd0 [ 44.932022] ? kvm_io_bus_get_dev+0x2a0/0x2a0 [ 44.932827] hardware_disable_nolock+0x30/0x40 [ 44.933591] on_each_cpu+0xca/0x1b0 [ 44.934283] hardware_disable_all_nolock+0x3e/0x50 [ 44.935168] kvm_put_kvm+0x956/0xdf0 [ 44.935781] ? kvm_clear_guest+0xb0/0xb0 [ 44.936543] ? kvm_irqfd_release+0xd1/0x120 [ 44.937360] ? lock_downgrade+0x990/0x990 [ 44.938162] ? _raw_spin_unlock_irq+0x27/0x70 [ 44.938903] ? kvm_irqfd_release+0xdd/0x120 [ 44.939676] ? kvm_irqfd_release+0xdd/0x120 [ 44.940459] ? kvm_put_kvm+0xdf0/0xdf0 [ 44.941092] kvm_vm_release+0x42/0x50 [ 44.941804] __fput+0x327/0x7e0 [ 44.942447] ? fput+0x140/0x140 [ 44.942966] ? check_same_owner+0x320/0x320 [ 44.943738] ? _raw_spin_unlock_irq+0x27/0x70 [ 44.944435] ____fput+0x15/0x20 [ 44.945026] task_work_run+0x199/0x270 [ 44.945734] ? task_work_cancel+0x210/0x210 [ 44.946406] ? _raw_spin_unlock+0x22/0x30 [ 44.947114] ? switch_task_namespaces+0x87/0xc0 [ 44.947927] do_exit+0x9b5/0x1ad0 [ 44.948463] ? lock_acquire+0x1d5/0x580 [ 44.949149] ? lock_acquire+0x1d5/0x580 [ 44.949776] ? mm_update_next_owner+0x930/0x930 [ 44.950577] ? lock_release+0xa40/0xa40 [ 44.951220] ? check_same_owner+0x320/0x320 [ 44.951906] ? check_noncircular+0x20/0x20 [ 44.952622] ? _raw_spin_unlock_irq+0x27/0x70 [ 44.953402] ? recalc_sigpending_tsk+0x117/0x150 [ 44.954328] ? ptrace_stop+0x631/0xa40 [ 44.954916] ? find_held_lock+0x35/0x1d0 [ 44.955617] ? ptrace_notify+0xee/0x130 [ 44.956208] ? lock_downgrade+0x990/0x990 [ 44.956862] ? do_raw_spin_trylock+0x190/0x190 [ 44.957615] ? _raw_spin_unlock_irq+0x27/0x70 [ 44.958300] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 44.959100] ? trace_hardirqs_on+0xd/0x10 [ 44.959794] ? _raw_spin_unlock_irq+0x27/0x70 [ 44.960512] ? ptrace_notify+0xee/0x130 [ 44.961106] ? syscall_trace_enter+0x5d4/0x1290 [ 44.961850] ? trace_raw_output_sys_exit+0x100/0x100 [ 44.962624] ? exit_to_usermode_loop+0x8c/0x310 [ 44.963328] do_group_exit+0x149/0x400 [ 44.963977] ? trace_hardirqs_off+0xd/0x10 [ 44.964590] ? exit_to_usermode_loop+0x198/0x310 [ 44.965363] ? SyS_exit+0x30/0x30 [ 44.965963] ? trace_event_raw_event_sys_exit+0x260/0x260 [ 44.966742] ? do_syscall_64+0xb6/0x8d0 [ 44.967376] ? do_group_exit+0x400/0x400 [ 44.968026] SyS_exit_group+0x1d/0x20 [ 44.968568] do_syscall_64+0x26c/0x8d0 [ 44.969198] ? kill_pid+0x30/0x30 [ 44.969703] ? syscall_return_slowpath+0x510/0x510 [ 44.970471] ? syscall_return_slowpath+0x2b3/0x510 [ 44.971196] ? prepare_exit_to_usermode+0x2d0/0x2d0 [ 44.971924] ? return_from_SYSCALL_64+0x2d/0x7a [ 44.972665] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 44.973473] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 44.974156] entry_SYSCALL64_slow_path+0x25/0x25 [ 44.974890] RIP: 0033:0x443849 [ 44.975331] RSP: 002b:00007ffcf97c1d48 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 44.976464] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 [ 44.977551] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 44.978646] RBP: 00000000004b5e88 R08: 000000000000003c R09: 00000000000000e7 [ 44.979696] R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000001 [ 44.980755] R13: 00000000006c52c0 R14: 0000000000404890 R15: 0000000000000000 [ 44.981825] Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d [ 44.984645] RIP: native_write_cr4+0x4/0x10 RSP: ffff88006babf458 [ 44.985583] ---[ end trace 45dae0ba7fdb5e5f ]--- > execve("./a.out", ["./a.out"], [/* 32 vars */]) = 0 > uname({sysname="Linux", nodename="kernel", ...}) = 0 > brk(NULL) = 0x1d42000 > brk(0x1d431c0) = 0x1d431c0 > arch_prctl(ARCH_SET_FS, 0x1d42880) = 0 > readlink("/proc/self/exe", "/home/kernel/a.out", 4096) = 18 > brk(0x1d641c0) = 0x1d641c0 > brk(0x1d65000) = 0x1d65000 > access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) > mmap(0x20000000, 11481088, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 > openat(AT_FDCWD, "/dev/kvm", O_WRONLY) = 3 > ioctl(3, KVM_CREATE_VM or LOGGER_GET_LOG_BUF_SIZE, 0) = 4 > ioctl(4, KVM_CREATE_VCPU, 0) = 5 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1170) = 0 > ioctl(5, KVM_GET_SREGS, 0x7fff5e6c1330) = 0 > open("/dev/kvm", O_RDWR) = 6 > ioctl(6, KVM_GET_SUPPORTED_CPUID, 0x7fff5e6c1470) = 0 > ioctl(5, KVM_SET_CPUID2, 0x7fff5e6c1470) = 0 > close(6) = 0 > ioctl(5, KVM_SET_MSRS, 0x7fff5e6c0c30) = 5 > ioctl(5, KVM_SET_SREGS, 0x7fff5e6c1330) = 0 > ioctl(5, KVM_SET_REGS, 0x7fff5e6c1230) = 0 > mremap(0x20998000, 4096, 16384, MREMAP_MAYMOVE|MREMAP_FIXED, > 0x200fa000) = 0x200fa000 > ioctl(5, KVM_RUN, 0) = 0 > mbind(0x20000000, 8192, MPOL_DEFAULT 0x20001ff8, 2, MPOL_MF_MOVE) = 0 > exit_group(0) = ? > +++ exited with 0 +++ > i > > Regards, > Wanpeng Li > >> general protection fault: 0000 [#1] SMP KASAN >> Modules linked in: >> CPU: 1 PID: 3064 Comm: a.out Not tainted 4.14.0-rc6+ #11 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >> task: ffff880064c203c0 task.stack: ffff880066718000 >> RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 >> RSP: 0018:ffff88006671f598 EFLAGS: 00010097 >> RAX: ffff880064c203c0 RBX: 00000000001606e0 RCX: 0000000000000000 >> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 >> RBP: ffff88006671f598 R08: 0000000000000006 R09: 0000000000000006 >> R10: ffff880064c203c0 R11: 0000000000000000 R12: 0000000000000001 >> R13: ffff88006ca94828 R14: ffff88006ca94850 R15: ffff88006ca80000 >> FS: 00000000019cd880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: 0000000000000000 CR3: 0000000005a22001 CR4: 00000000001626e0 >> Call Trace: >> __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline] >> cr4_clear_bits arch/x86/include/asm/tlbflush.h:197 [inline] >> kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3571 [inline] >> hardware_disable+0x197/0x210 arch/x86/kvm/vmx.c:3577 >> kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:7920 >> hardware_disable_nolock+0x30/0x40 >> arch/x86/kvm/../../../virt/kvm/kvm_main.c:3282 >> on_each_cpu+0xca/0x1b0 kernel/smp.c:604 >> hardware_disable_all_nolock+0x44/0x60 >> arch/x86/kvm/../../../virt/kvm/kvm_main.c:3300 >> hardware_disable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3306 [inline] >> kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:735 [inline] >> kvm_put_kvm+0x887/0xe00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 >> kvm_vm_release+0x42/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:759 >> __fput+0x301/0x7e0 fs/file_table.c:210 >> ____fput+0x15/0x20 fs/file_table.c:244 >> task_work_run+0x19e/0x250 kernel/task_work.c:112 >> exit_task_work include/linux/task_work.h:21 [inline] >> do_exit+0x99f/0x18b0 kernel/exit.c:865 >> do_group_exit+0x14b/0x3f0 kernel/exit.c:968 >> SYSC_exit_group kernel/exit.c:979 [inline] >> SyS_exit_group+0x1d/0x20 kernel/exit.c:977 >> entry_SYSCALL_64_fastpath+0x1f/0xbe >> RIP: 0033:0x443849 >> RSP: 002b:00007ffe58a95c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 >> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 >> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 >> RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 >> R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 >> R13: 0000000000404800 R14: 0000000000404890 R15: 0000000000000000 >> Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 >> 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> >> 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d >> RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 >> RSP: ffff88006671f598 >> ---[ end trace 6f9dbcc14aa47936 ]--- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: kvm: GPF in native_write_cr4 2017-10-31 11:24 ` Dmitry Vyukov @ 2017-10-31 11:25 ` Dmitry Vyukov 0 siblings, 0 replies; 8+ messages in thread From: Dmitry Vyukov @ 2017-10-31 11:25 UTC (permalink / raw) To: Wanpeng Li Cc: Paolo Bonzini, Radim Krčmář, KVM list, LKML, Haozhong Zhang, David Hildenbrand, syzkaller -obsolete email address On Tue, Oct 31, 2017 at 2:24 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Tue, Oct 31, 2017 at 2:10 PM, Wanpeng Li <kernellwp@gmail.com> wrote: >> 2017-10-31 17:59 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>: >>> Hello, >>> >>> I am seeing the following crash on upstream >>> 15f859ae5c43c7f0a064ed92d33f7a5bc5de6de0 (Oct 26). >>> Reproducer: >>> https://gist.githubusercontent.com/dvyukov/a9690f90c39c1e3b1b6c7acda2d5ef89/raw/33e07f3d6779005fc475764e0802e4a5aee8d0cf/gistfile1.txt >>> I run qemu with -append "kvm-intel.nested=1" -enable-kvm -cpu host. My >>> host cpu is E5-2690. >>> >> >> I can't reproduce this w/ latest kvm/queue in both L0 and L1. In >> addition, there is a commit tries to fix cr4 recently. >> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=8eb3f87d903168bdbd1222776a6b1e281f50513e >> The testcast is complex, if the below strace log is as you expected? > > > I have that commit in my tree. > > I did a little testing and if I remove "-cpu host" from qemu command > line, then crash does not happen. So my E5-2690 is somehow involved. > > The test case is actually for a different issues, but since recently > lots of kvm-related programs trigger this bug for me. And it seems to > be very easy to trigger. Here is my strace output: > > > root@syzkaller:~# strace ./a.out > execve("./a.out", ["./a.out"], [/* 11 vars */]) = 0 > uname({sys="Linux", node="syzkaller", ...}) = 0 > brk(0) = 0xe3c000 > brk(0xe3d1c0) = 0xe3d1c0 > arch_prctl(ARCH_SET_FS, 0xe3c880) = 0 > readlink("/proc/self/exe", "/root/a.out", 4096) = 11 > brk(0xe5e1c0) = 0xe5e1c0 > brk(0xe5f000) = 0xe5f000 > access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) > mmap(0x20000000, 11481088, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 > openat(AT_FDCWD, "/dev/kvm", O_WRONLY) = 3 > ioctl(3, KVM_CREATE_VM > > , 0) = 4 > ioctl(4, KVM_CREATE_VCPU, 0) = 5 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c07f0) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7ffcf97c0630) = 0 > ioctl(5, KVM_GET_SREGS, 0x7ffcf97c07f0) = 0 > open("/dev/kvm", O_RDWR) = 6 > ioctl(6, KVM_GET_SUPPORTED_CPUID, 0x7ffcf97c0930) = 0 > ioctl(5, KVM_SET_CPUID2, 0x7ffcf97c0930) = 0 > close(6) = 0 > ioctl(5, KVM_SET_MSRS, 0x7ffcf97c00f0) = 5 > ioctl(5, KVM_SET_SREGS, 0x7ffcf97c07f0) = 0 > ioctl(5, KVM_SET_REGS, 0x7ffcf97c0760) = 0 > mremap(0x20998000, 4096, 16384, MREMAP_MAYMOVE|MREMAP_FIXED, > 0x200fa000) = 0x200fa000 > ioctl(5, KVM_RUN, 0) = 0 > mbind(0x20000000, 8192, MPOL_DEFAULT, 0x20001ff8, 2, MPOL_MF_MOVE) = 0 > exit_group(0) = ? > [ 44.908130] kasan: CONFIG_KASAN_INLINE enabled > [ 44.909140] kasan: GPF could be caused by NULL-ptr deref or user > memory access > [ 44.910615] general protection fault: 0000 [#1] SMP KASAN > [ 44.911654] Modules linked in: > [ 44.912241] CPU: 2 PID: 3074 Comm: a.out Not tainted 4.14.0-rc6+ #12 > [ 44.913556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), > BIOS Bochs 01/01/2011 > [ 44.915146] task: ffff88006a8e0740 task.stack: ffff88006bab8000 > [ 44.916387] RIP: 0010:native_write_cr4+0x4/0x10 > [ 44.917324] RSP: 0018:ffff88006babf458 EFLAGS: 00010097 > [ 44.918373] RAX: ffff88006a8e0740 RBX: 00000000001606e0 RCX: 0000000000000000 > [ 44.919693] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 > [ 44.921049] RBP: ffff88006babf458 R08: ffffffff8106cf91 R09: 0000000000000000 > [ 44.922417] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 > [ 44.923738] R13: ffff88006cb14828 R14: ffff88006cb14850 R15: ffff88006cb00000 > [ 44.925061] FS: 0000000000e3c880(0000) GS:ffff88006cb00000(0000) > knlGS:0000000000000000 > [ 44.926652] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 44.927727] CR2: 0000000000000000 CR3: 0000000005a22004 CR4: 00000000001626e0 > [ 44.929067] Call Trace: > [ 44.929627] hardware_disable+0x17f/0x210 > [ 44.930373] ? kvm_io_bus_get_dev+0x2a0/0x2a0 > [ 44.931148] kvm_arch_hardware_disable+0x35/0xd0 > [ 44.932022] ? kvm_io_bus_get_dev+0x2a0/0x2a0 > [ 44.932827] hardware_disable_nolock+0x30/0x40 > [ 44.933591] on_each_cpu+0xca/0x1b0 > [ 44.934283] hardware_disable_all_nolock+0x3e/0x50 > [ 44.935168] kvm_put_kvm+0x956/0xdf0 > [ 44.935781] ? kvm_clear_guest+0xb0/0xb0 > [ 44.936543] ? kvm_irqfd_release+0xd1/0x120 > [ 44.937360] ? lock_downgrade+0x990/0x990 > [ 44.938162] ? _raw_spin_unlock_irq+0x27/0x70 > [ 44.938903] ? kvm_irqfd_release+0xdd/0x120 > [ 44.939676] ? kvm_irqfd_release+0xdd/0x120 > [ 44.940459] ? kvm_put_kvm+0xdf0/0xdf0 > [ 44.941092] kvm_vm_release+0x42/0x50 > [ 44.941804] __fput+0x327/0x7e0 > [ 44.942447] ? fput+0x140/0x140 > [ 44.942966] ? check_same_owner+0x320/0x320 > [ 44.943738] ? _raw_spin_unlock_irq+0x27/0x70 > [ 44.944435] ____fput+0x15/0x20 > [ 44.945026] task_work_run+0x199/0x270 > [ 44.945734] ? task_work_cancel+0x210/0x210 > [ 44.946406] ? _raw_spin_unlock+0x22/0x30 > [ 44.947114] ? switch_task_namespaces+0x87/0xc0 > [ 44.947927] do_exit+0x9b5/0x1ad0 > [ 44.948463] ? lock_acquire+0x1d5/0x580 > [ 44.949149] ? lock_acquire+0x1d5/0x580 > [ 44.949776] ? mm_update_next_owner+0x930/0x930 > [ 44.950577] ? lock_release+0xa40/0xa40 > [ 44.951220] ? check_same_owner+0x320/0x320 > [ 44.951906] ? check_noncircular+0x20/0x20 > [ 44.952622] ? _raw_spin_unlock_irq+0x27/0x70 > [ 44.953402] ? recalc_sigpending_tsk+0x117/0x150 > [ 44.954328] ? ptrace_stop+0x631/0xa40 > [ 44.954916] ? find_held_lock+0x35/0x1d0 > [ 44.955617] ? ptrace_notify+0xee/0x130 > [ 44.956208] ? lock_downgrade+0x990/0x990 > [ 44.956862] ? do_raw_spin_trylock+0x190/0x190 > [ 44.957615] ? _raw_spin_unlock_irq+0x27/0x70 > [ 44.958300] ? trace_hardirqs_on_caller+0x421/0x5c0 > [ 44.959100] ? trace_hardirqs_on+0xd/0x10 > [ 44.959794] ? _raw_spin_unlock_irq+0x27/0x70 > [ 44.960512] ? ptrace_notify+0xee/0x130 > [ 44.961106] ? syscall_trace_enter+0x5d4/0x1290 > [ 44.961850] ? trace_raw_output_sys_exit+0x100/0x100 > [ 44.962624] ? exit_to_usermode_loop+0x8c/0x310 > [ 44.963328] do_group_exit+0x149/0x400 > [ 44.963977] ? trace_hardirqs_off+0xd/0x10 > [ 44.964590] ? exit_to_usermode_loop+0x198/0x310 > [ 44.965363] ? SyS_exit+0x30/0x30 > [ 44.965963] ? trace_event_raw_event_sys_exit+0x260/0x260 > [ 44.966742] ? do_syscall_64+0xb6/0x8d0 > [ 44.967376] ? do_group_exit+0x400/0x400 > [ 44.968026] SyS_exit_group+0x1d/0x20 > [ 44.968568] do_syscall_64+0x26c/0x8d0 > [ 44.969198] ? kill_pid+0x30/0x30 > [ 44.969703] ? syscall_return_slowpath+0x510/0x510 > [ 44.970471] ? syscall_return_slowpath+0x2b3/0x510 > [ 44.971196] ? prepare_exit_to_usermode+0x2d0/0x2d0 > [ 44.971924] ? return_from_SYSCALL_64+0x2d/0x7a > [ 44.972665] ? trace_hardirqs_on_caller+0x421/0x5c0 > [ 44.973473] ? trace_hardirqs_on_thunk+0x1a/0x1c > [ 44.974156] entry_SYSCALL64_slow_path+0x25/0x25 > [ 44.974890] RIP: 0033:0x443849 > [ 44.975331] RSP: 002b:00007ffcf97c1d48 EFLAGS: 00000246 ORIG_RAX: > 00000000000000e7 > [ 44.976464] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 > [ 44.977551] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > [ 44.978646] RBP: 00000000004b5e88 R08: 000000000000003c R09: 00000000000000e7 > [ 44.979696] R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000001 > [ 44.980755] R13: 00000000006c52c0 R14: 0000000000404890 R15: 0000000000000000 > [ 44.981825] Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 > 0f 1f 80 00 00 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 > 55 48 89 e5 <0f> 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 > c0 5d > [ 44.984645] RIP: native_write_cr4+0x4/0x10 RSP: ffff88006babf458 > [ 44.985583] ---[ end trace 45dae0ba7fdb5e5f ]--- > > > > > >> execve("./a.out", ["./a.out"], [/* 32 vars */]) = 0 >> uname({sysname="Linux", nodename="kernel", ...}) = 0 >> brk(NULL) = 0x1d42000 >> brk(0x1d431c0) = 0x1d431c0 >> arch_prctl(ARCH_SET_FS, 0x1d42880) = 0 >> readlink("/proc/self/exe", "/home/kernel/a.out", 4096) = 18 >> brk(0x1d641c0) = 0x1d641c0 >> brk(0x1d65000) = 0x1d65000 >> access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) >> mmap(0x20000000, 11481088, PROT_READ|PROT_WRITE, >> MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 >> openat(AT_FDCWD, "/dev/kvm", O_WRONLY) = 3 >> ioctl(3, KVM_CREATE_VM or LOGGER_GET_LOG_BUF_SIZE, 0) = 4 >> ioctl(4, KVM_CREATE_VCPU, 0) = 5 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1170) = 0 >> ioctl(5, KVM_GET_SREGS, 0x7fff5e6c1330) = 0 >> open("/dev/kvm", O_RDWR) = 6 >> ioctl(6, KVM_GET_SUPPORTED_CPUID, 0x7fff5e6c1470) = 0 >> ioctl(5, KVM_SET_CPUID2, 0x7fff5e6c1470) = 0 >> close(6) = 0 >> ioctl(5, KVM_SET_MSRS, 0x7fff5e6c0c30) = 5 >> ioctl(5, KVM_SET_SREGS, 0x7fff5e6c1330) = 0 >> ioctl(5, KVM_SET_REGS, 0x7fff5e6c1230) = 0 >> mremap(0x20998000, 4096, 16384, MREMAP_MAYMOVE|MREMAP_FIXED, >> 0x200fa000) = 0x200fa000 >> ioctl(5, KVM_RUN, 0) = 0 >> mbind(0x20000000, 8192, MPOL_DEFAULT 0x20001ff8, 2, MPOL_MF_MOVE) = 0 >> exit_group(0) = ? >> +++ exited with 0 +++ >> i >> >> Regards, >> Wanpeng Li >> >>> general protection fault: 0000 [#1] SMP KASAN >>> Modules linked in: >>> CPU: 1 PID: 3064 Comm: a.out Not tainted 4.14.0-rc6+ #11 >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >>> task: ffff880064c203c0 task.stack: ffff880066718000 >>> RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 >>> RSP: 0018:ffff88006671f598 EFLAGS: 00010097 >>> RAX: ffff880064c203c0 RBX: 00000000001606e0 RCX: 0000000000000000 >>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 >>> RBP: ffff88006671f598 R08: 0000000000000006 R09: 0000000000000006 >>> R10: ffff880064c203c0 R11: 0000000000000000 R12: 0000000000000001 >>> R13: ffff88006ca94828 R14: ffff88006ca94850 R15: ffff88006ca80000 >>> FS: 00000000019cd880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >>> CR2: 0000000000000000 CR3: 0000000005a22001 CR4: 00000000001626e0 >>> Call Trace: >>> __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline] >>> cr4_clear_bits arch/x86/include/asm/tlbflush.h:197 [inline] >>> kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3571 [inline] >>> hardware_disable+0x197/0x210 arch/x86/kvm/vmx.c:3577 >>> kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:7920 >>> hardware_disable_nolock+0x30/0x40 >>> arch/x86/kvm/../../../virt/kvm/kvm_main.c:3282 >>> on_each_cpu+0xca/0x1b0 kernel/smp.c:604 >>> hardware_disable_all_nolock+0x44/0x60 >>> arch/x86/kvm/../../../virt/kvm/kvm_main.c:3300 >>> hardware_disable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3306 [inline] >>> kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:735 [inline] >>> kvm_put_kvm+0x887/0xe00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 >>> kvm_vm_release+0x42/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:759 >>> __fput+0x301/0x7e0 fs/file_table.c:210 >>> ____fput+0x15/0x20 fs/file_table.c:244 >>> task_work_run+0x19e/0x250 kernel/task_work.c:112 >>> exit_task_work include/linux/task_work.h:21 [inline] >>> do_exit+0x99f/0x18b0 kernel/exit.c:865 >>> do_group_exit+0x14b/0x3f0 kernel/exit.c:968 >>> SYSC_exit_group kernel/exit.c:979 [inline] >>> SyS_exit_group+0x1d/0x20 kernel/exit.c:977 >>> entry_SYSCALL_64_fastpath+0x1f/0xbe >>> RIP: 0033:0x443849 >>> RSP: 002b:00007ffe58a95c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 >>> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 >>> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 >>> RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 >>> R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 >>> R13: 0000000000404800 R14: 0000000000404890 R15: 0000000000000000 >>> Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 >>> 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> >>> 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d >>> RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 >>> RSP: ffff88006671f598 >>> ---[ end trace 6f9dbcc14aa47936 ]--- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: kvm: GPF in native_write_cr4 2017-10-31 11:10 ` Wanpeng Li 2017-10-31 11:24 ` Dmitry Vyukov @ 2017-10-31 12:53 ` Haozhong Zhang 2017-10-31 13:07 ` Dmitry Vyukov 1 sibling, 1 reply; 8+ messages in thread From: Haozhong Zhang @ 2017-10-31 12:53 UTC (permalink / raw) To: Wanpeng Li Cc: Dmitry Vyukov, Paolo Bonzini, Radim Krčmář, KVM list, LKML, Xiao Guangrong, David Hildenbrand, syzkaller Hi Wanpeng, On 10/31/17 19:10 +0800, Wanpeng Li wrote: > 2017-10-31 17:59 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>: > > Hello, > > > > I am seeing the following crash on upstream > > 15f859ae5c43c7f0a064ed92d33f7a5bc5de6de0 (Oct 26). > > Reproducer: > > https://gist.githubusercontent.com/dvyukov/a9690f90c39c1e3b1b6c7acda2d5ef89/raw/33e07f3d6779005fc475764e0802e4a5aee8d0cf/gistfile1.txt > > I run qemu with -append "kvm-intel.nested=1" -enable-kvm -cpu host. My > > host cpu is E5-2690. > > > > I can't reproduce this w/ latest kvm/queue in both L0 and L1. In > addition, there is a commit tries to fix cr4 recently. > https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=8eb3f87d903168bdbd1222776a6b1e281f50513e The calltrace in this bug report is the same as what I got before above commit. In the previous bug, L0 KVM misused L2 CR4 as L1 CR4. When L1 KVM tried to clear L1 CR4.VMXE in L1 VM shutdown path, L0 KVM considered L1 intended to clear/set other bits as well (because of the wrong L2 CR4 was used by L0 KVM as L1 CR4), but changes to extra bits may not be allowed against other L1 states. In my previous fix, I tried to fix one place of such L1/L2 CR4 misuse. If there is no other places of CR4 misuse, you may have a look at the guest states checked by kvm_set_cr4() against guest CR4 changes, and check whether L1 and L2 versions of any of them are misused. It would make the debug easier if we can log which check fails in kvm_set_cr4() when the calltrace appears (e.g., by adding printk before return 1 in kvm_set_cr4()). Haozhong > The testcast is complex, if the below strace log is as you expected? > > execve("./a.out", ["./a.out"], [/* 32 vars */]) = 0 > uname({sysname="Linux", nodename="kernel", ...}) = 0 > brk(NULL) = 0x1d42000 > brk(0x1d431c0) = 0x1d431c0 > arch_prctl(ARCH_SET_FS, 0x1d42880) = 0 > readlink("/proc/self/exe", "/home/kernel/a.out", 4096) = 18 > brk(0x1d641c0) = 0x1d641c0 > brk(0x1d65000) = 0x1d65000 > access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) > mmap(0x20000000, 11481088, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 > openat(AT_FDCWD, "/dev/kvm", O_WRONLY) = 3 > ioctl(3, KVM_CREATE_VM or LOGGER_GET_LOG_BUF_SIZE, 0) = 4 > ioctl(4, KVM_CREATE_VCPU, 0) = 5 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 > ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1170) = 0 > ioctl(5, KVM_GET_SREGS, 0x7fff5e6c1330) = 0 > open("/dev/kvm", O_RDWR) = 6 > ioctl(6, KVM_GET_SUPPORTED_CPUID, 0x7fff5e6c1470) = 0 > ioctl(5, KVM_SET_CPUID2, 0x7fff5e6c1470) = 0 > close(6) = 0 > ioctl(5, KVM_SET_MSRS, 0x7fff5e6c0c30) = 5 > ioctl(5, KVM_SET_SREGS, 0x7fff5e6c1330) = 0 > ioctl(5, KVM_SET_REGS, 0x7fff5e6c1230) = 0 > mremap(0x20998000, 4096, 16384, MREMAP_MAYMOVE|MREMAP_FIXED, > 0x200fa000) = 0x200fa000 > ioctl(5, KVM_RUN, 0) = 0 > mbind(0x20000000, 8192, MPOL_DEFAULT 0x20001ff8, 2, MPOL_MF_MOVE) = 0 > exit_group(0) = ? > +++ exited with 0 +++ > i > > Regards, > Wanpeng Li > > > general protection fault: 0000 [#1] SMP KASAN > > Modules linked in: > > CPU: 1 PID: 3064 Comm: a.out Not tainted 4.14.0-rc6+ #11 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > > task: ffff880064c203c0 task.stack: ffff880066718000 > > RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 > > RSP: 0018:ffff88006671f598 EFLAGS: 00010097 > > RAX: ffff880064c203c0 RBX: 00000000001606e0 RCX: 0000000000000000 > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 > > RBP: ffff88006671f598 R08: 0000000000000006 R09: 0000000000000006 > > R10: ffff880064c203c0 R11: 0000000000000000 R12: 0000000000000001 > > R13: ffff88006ca94828 R14: ffff88006ca94850 R15: ffff88006ca80000 > > FS: 00000000019cd880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 0000000000000000 CR3: 0000000005a22001 CR4: 00000000001626e0 > > Call Trace: > > __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline] > > cr4_clear_bits arch/x86/include/asm/tlbflush.h:197 [inline] > > kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3571 [inline] > > hardware_disable+0x197/0x210 arch/x86/kvm/vmx.c:3577 > > kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:7920 > > hardware_disable_nolock+0x30/0x40 > > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3282 > > on_each_cpu+0xca/0x1b0 kernel/smp.c:604 > > hardware_disable_all_nolock+0x44/0x60 > > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3300 > > hardware_disable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3306 [inline] > > kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:735 [inline] > > kvm_put_kvm+0x887/0xe00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 > > kvm_vm_release+0x42/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:759 > > __fput+0x301/0x7e0 fs/file_table.c:210 > > ____fput+0x15/0x20 fs/file_table.c:244 > > task_work_run+0x19e/0x250 kernel/task_work.c:112 > > exit_task_work include/linux/task_work.h:21 [inline] > > do_exit+0x99f/0x18b0 kernel/exit.c:865 > > do_group_exit+0x14b/0x3f0 kernel/exit.c:968 > > SYSC_exit_group kernel/exit.c:979 [inline] > > SyS_exit_group+0x1d/0x20 kernel/exit.c:977 > > entry_SYSCALL_64_fastpath+0x1f/0xbe > > RIP: 0033:0x443849 > > RSP: 002b:00007ffe58a95c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 > > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > > RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 > > R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 > > R13: 0000000000404800 R14: 0000000000404890 R15: 0000000000000000 > > Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 > > 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> > > 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d > > RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 > > RSP: ffff88006671f598 > > ---[ end trace 6f9dbcc14aa47936 ]--- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: kvm: GPF in native_write_cr4 2017-10-31 12:53 ` Haozhong Zhang @ 2017-10-31 13:07 ` Dmitry Vyukov 2017-11-06 9:48 ` Dmitry Vyukov 0 siblings, 1 reply; 8+ messages in thread From: Dmitry Vyukov @ 2017-10-31 13:07 UTC (permalink / raw) To: Wanpeng Li, Dmitry Vyukov, Paolo Bonzini, Radim Krčmář, KVM list, LKML, Xiao Guangrong, David Hildenbrand, syzkaller On Tue, Oct 31, 2017 at 3:53 PM, Haozhong Zhang <haozhong.zhang@intel.com> wrote: > Hi Wanpeng, > > On 10/31/17 19:10 +0800, Wanpeng Li wrote: >> 2017-10-31 17:59 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>: >> > Hello, >> > >> > I am seeing the following crash on upstream >> > 15f859ae5c43c7f0a064ed92d33f7a5bc5de6de0 (Oct 26). >> > Reproducer: >> > https://gist.githubusercontent.com/dvyukov/a9690f90c39c1e3b1b6c7acda2d5ef89/raw/33e07f3d6779005fc475764e0802e4a5aee8d0cf/gistfile1.txt >> > I run qemu with -append "kvm-intel.nested=1" -enable-kvm -cpu host. My >> > host cpu is E5-2690. >> > >> >> I can't reproduce this w/ latest kvm/queue in both L0 and L1. In >> addition, there is a commit tries to fix cr4 recently. >> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=8eb3f87d903168bdbd1222776a6b1e281f50513e > > The calltrace in this bug report is the same as what I got before > above commit. > > In the previous bug, L0 KVM misused L2 CR4 as L1 CR4. When L1 KVM > tried to clear L1 CR4.VMXE in L1 VM shutdown path, L0 KVM considered > L1 intended to clear/set other bits as well (because of the wrong L2 > CR4 was used by L0 KVM as L1 CR4), but changes to extra bits may not > be allowed against other L1 states. > > In my previous fix, I tried to fix one place of such L1/L2 CR4 > misuse. If there is no other places of CR4 misuse, you may have a look > at the guest states checked by kvm_set_cr4() against guest CR4 > changes, and check whether L1 and L2 versions of any of them are > misused. > > It would make the debug easier if we can log which check fails in > kvm_set_cr4() when the calltrace appears (e.g., by adding printk > before return 1 in kvm_set_cr4()). > > > Haozhong To double-check I've also tried latest upstream 5f479447d983111c039f1d6d958553c1ad1b2ff1 (Oct 30) and the bug still reproduces. So it reproduces with the mentioned fix. >> The testcast is complex, if the below strace log is as you expected? >> >> execve("./a.out", ["./a.out"], [/* 32 vars */]) = 0 >> uname({sysname="Linux", nodename="kernel", ...}) = 0 >> brk(NULL) = 0x1d42000 >> brk(0x1d431c0) = 0x1d431c0 >> arch_prctl(ARCH_SET_FS, 0x1d42880) = 0 >> readlink("/proc/self/exe", "/home/kernel/a.out", 4096) = 18 >> brk(0x1d641c0) = 0x1d641c0 >> brk(0x1d65000) = 0x1d65000 >> access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) >> mmap(0x20000000, 11481088, PROT_READ|PROT_WRITE, >> MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 >> openat(AT_FDCWD, "/dev/kvm", O_WRONLY) = 3 >> ioctl(3, KVM_CREATE_VM or LOGGER_GET_LOG_BUF_SIZE, 0) = 4 >> ioctl(4, KVM_CREATE_VCPU, 0) = 5 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1170) = 0 >> ioctl(5, KVM_GET_SREGS, 0x7fff5e6c1330) = 0 >> open("/dev/kvm", O_RDWR) = 6 >> ioctl(6, KVM_GET_SUPPORTED_CPUID, 0x7fff5e6c1470) = 0 >> ioctl(5, KVM_SET_CPUID2, 0x7fff5e6c1470) = 0 >> close(6) = 0 >> ioctl(5, KVM_SET_MSRS, 0x7fff5e6c0c30) = 5 >> ioctl(5, KVM_SET_SREGS, 0x7fff5e6c1330) = 0 >> ioctl(5, KVM_SET_REGS, 0x7fff5e6c1230) = 0 >> mremap(0x20998000, 4096, 16384, MREMAP_MAYMOVE|MREMAP_FIXED, >> 0x200fa000) = 0x200fa000 >> ioctl(5, KVM_RUN, 0) = 0 >> mbind(0x20000000, 8192, MPOL_DEFAULT 0x20001ff8, 2, MPOL_MF_MOVE) = 0 >> exit_group(0) = ? >> +++ exited with 0 +++ >> i >> >> Regards, >> Wanpeng Li >> >> > general protection fault: 0000 [#1] SMP KASAN >> > Modules linked in: >> > CPU: 1 PID: 3064 Comm: a.out Not tainted 4.14.0-rc6+ #11 >> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >> > task: ffff880064c203c0 task.stack: ffff880066718000 >> > RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 >> > RSP: 0018:ffff88006671f598 EFLAGS: 00010097 >> > RAX: ffff880064c203c0 RBX: 00000000001606e0 RCX: 0000000000000000 >> > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 >> > RBP: ffff88006671f598 R08: 0000000000000006 R09: 0000000000000006 >> > R10: ffff880064c203c0 R11: 0000000000000000 R12: 0000000000000001 >> > R13: ffff88006ca94828 R14: ffff88006ca94850 R15: ffff88006ca80000 >> > FS: 00000000019cd880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 >> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> > CR2: 0000000000000000 CR3: 0000000005a22001 CR4: 00000000001626e0 >> > Call Trace: >> > __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline] >> > cr4_clear_bits arch/x86/include/asm/tlbflush.h:197 [inline] >> > kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3571 [inline] >> > hardware_disable+0x197/0x210 arch/x86/kvm/vmx.c:3577 >> > kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:7920 >> > hardware_disable_nolock+0x30/0x40 >> > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3282 >> > on_each_cpu+0xca/0x1b0 kernel/smp.c:604 >> > hardware_disable_all_nolock+0x44/0x60 >> > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3300 >> > hardware_disable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3306 [inline] >> > kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:735 [inline] >> > kvm_put_kvm+0x887/0xe00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 >> > kvm_vm_release+0x42/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:759 >> > __fput+0x301/0x7e0 fs/file_table.c:210 >> > ____fput+0x15/0x20 fs/file_table.c:244 >> > task_work_run+0x19e/0x250 kernel/task_work.c:112 >> > exit_task_work include/linux/task_work.h:21 [inline] >> > do_exit+0x99f/0x18b0 kernel/exit.c:865 >> > do_group_exit+0x14b/0x3f0 kernel/exit.c:968 >> > SYSC_exit_group kernel/exit.c:979 [inline] >> > SyS_exit_group+0x1d/0x20 kernel/exit.c:977 >> > entry_SYSCALL_64_fastpath+0x1f/0xbe >> > RIP: 0033:0x443849 >> > RSP: 002b:00007ffe58a95c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 >> > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 >> > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 >> > RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 >> > R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 >> > R13: 0000000000404800 R14: 0000000000404890 R15: 0000000000000000 >> > Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 >> > 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> >> > 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d >> > RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 >> > RSP: ffff88006671f598 >> > ---[ end trace 6f9dbcc14aa47936 ]--- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: kvm: GPF in native_write_cr4 2017-10-31 13:07 ` Dmitry Vyukov @ 2017-11-06 9:48 ` Dmitry Vyukov 0 siblings, 0 replies; 8+ messages in thread From: Dmitry Vyukov @ 2017-11-06 9:48 UTC (permalink / raw) To: Wanpeng Li, Dmitry Vyukov, Paolo Bonzini, Radim Krčmář, KVM list, LKML, Xiao Guangrong, David Hildenbrand, syzkaller, Jim Mattson On Tue, Oct 31, 2017 at 2:07 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Tue, Oct 31, 2017 at 3:53 PM, Haozhong Zhang > <haozhong.zhang@intel.com> wrote: >> Hi Wanpeng, >> >> On 10/31/17 19:10 +0800, Wanpeng Li wrote: >>> 2017-10-31 17:59 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>: >>> > Hello, >>> > >>> > I am seeing the following crash on upstream >>> > 15f859ae5c43c7f0a064ed92d33f7a5bc5de6de0 (Oct 26). >>> > Reproducer: >>> > https://gist.githubusercontent.com/dvyukov/a9690f90c39c1e3b1b6c7acda2d5ef89/raw/33e07f3d6779005fc475764e0802e4a5aee8d0cf/gistfile1.txt >>> > I run qemu with -append "kvm-intel.nested=1" -enable-kvm -cpu host. My >>> > host cpu is E5-2690. As +Jim pointed out, this is E5-2690 v3 to be more precise. >>> I can't reproduce this w/ latest kvm/queue in both L0 and L1. In >>> addition, there is a commit tries to fix cr4 recently. >>> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=8eb3f87d903168bdbd1222776a6b1e281f50513e >> >> The calltrace in this bug report is the same as what I got before >> above commit. >> >> In the previous bug, L0 KVM misused L2 CR4 as L1 CR4. When L1 KVM >> tried to clear L1 CR4.VMXE in L1 VM shutdown path, L0 KVM considered >> L1 intended to clear/set other bits as well (because of the wrong L2 >> CR4 was used by L0 KVM as L1 CR4), but changes to extra bits may not >> be allowed against other L1 states. >> >> In my previous fix, I tried to fix one place of such L1/L2 CR4 >> misuse. If there is no other places of CR4 misuse, you may have a look >> at the guest states checked by kvm_set_cr4() against guest CR4 >> changes, and check whether L1 and L2 versions of any of them are >> misused. >> >> It would make the debug easier if we can log which check fails in >> kvm_set_cr4() when the calltrace appears (e.g., by adding printk >> before return 1 in kvm_set_cr4()). >> >> >> Haozhong > > > To double-check I've also tried latest upstream > 5f479447d983111c039f1d6d958553c1ad1b2ff1 (Oct 30) and the bug still > reproduces. So it reproduces with the mentioned fix. > > > >>> The testcast is complex, if the below strace log is as you expected? >>> >>> execve("./a.out", ["./a.out"], [/* 32 vars */]) = 0 >>> uname({sysname="Linux", nodename="kernel", ...}) = 0 >>> brk(NULL) = 0x1d42000 >>> brk(0x1d431c0) = 0x1d431c0 >>> arch_prctl(ARCH_SET_FS, 0x1d42880) = 0 >>> readlink("/proc/self/exe", "/home/kernel/a.out", 4096) = 18 >>> brk(0x1d641c0) = 0x1d641c0 >>> brk(0x1d65000) = 0x1d65000 >>> access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) >>> mmap(0x20000000, 11481088, PROT_READ|PROT_WRITE, >>> MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 >>> openat(AT_FDCWD, "/dev/kvm", O_WRONLY) = 3 >>> ioctl(3, KVM_CREATE_VM or LOGGER_GET_LOG_BUF_SIZE, 0) = 4 >>> ioctl(4, KVM_CREATE_VCPU, 0) = 5 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1230) = 0 >>> ioctl(4, KVM_SET_USER_MEMORY_REGION, 0x7fff5e6c1170) = 0 >>> ioctl(5, KVM_GET_SREGS, 0x7fff5e6c1330) = 0 >>> open("/dev/kvm", O_RDWR) = 6 >>> ioctl(6, KVM_GET_SUPPORTED_CPUID, 0x7fff5e6c1470) = 0 >>> ioctl(5, KVM_SET_CPUID2, 0x7fff5e6c1470) = 0 >>> close(6) = 0 >>> ioctl(5, KVM_SET_MSRS, 0x7fff5e6c0c30) = 5 >>> ioctl(5, KVM_SET_SREGS, 0x7fff5e6c1330) = 0 >>> ioctl(5, KVM_SET_REGS, 0x7fff5e6c1230) = 0 >>> mremap(0x20998000, 4096, 16384, MREMAP_MAYMOVE|MREMAP_FIXED, >>> 0x200fa000) = 0x200fa000 >>> ioctl(5, KVM_RUN, 0) = 0 >>> mbind(0x20000000, 8192, MPOL_DEFAULT 0x20001ff8, 2, MPOL_MF_MOVE) = 0 >>> exit_group(0) = ? >>> +++ exited with 0 +++ >>> i >>> >>> Regards, >>> Wanpeng Li >>> >>> > general protection fault: 0000 [#1] SMP KASAN >>> > Modules linked in: >>> > CPU: 1 PID: 3064 Comm: a.out Not tainted 4.14.0-rc6+ #11 >>> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >>> > task: ffff880064c203c0 task.stack: ffff880066718000 >>> > RIP: 0010:native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 >>> > RSP: 0018:ffff88006671f598 EFLAGS: 00010097 >>> > RAX: ffff880064c203c0 RBX: 00000000001606e0 RCX: 0000000000000000 >>> > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000001606e0 >>> > RBP: ffff88006671f598 R08: 0000000000000006 R09: 0000000000000006 >>> > R10: ffff880064c203c0 R11: 0000000000000000 R12: 0000000000000001 >>> > R13: ffff88006ca94828 R14: ffff88006ca94850 R15: ffff88006ca80000 >>> > FS: 00000000019cd880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 >>> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >>> > CR2: 0000000000000000 CR3: 0000000005a22001 CR4: 00000000001626e0 >>> > Call Trace: >>> > __write_cr4 arch/x86/include/asm/paravirt.h:76 [inline] >>> > cr4_clear_bits arch/x86/include/asm/tlbflush.h:197 [inline] >>> > kvm_cpu_vmxoff arch/x86/kvm/vmx.c:3571 [inline] >>> > hardware_disable+0x197/0x210 arch/x86/kvm/vmx.c:3577 >>> > kvm_arch_hardware_disable+0x35/0xd0 arch/x86/kvm/x86.c:7920 >>> > hardware_disable_nolock+0x30/0x40 >>> > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3282 >>> > on_each_cpu+0xca/0x1b0 kernel/smp.c:604 >>> > hardware_disable_all_nolock+0x44/0x60 >>> > arch/x86/kvm/../../../virt/kvm/kvm_main.c:3300 >>> > hardware_disable_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:3306 [inline] >>> > kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:735 [inline] >>> > kvm_put_kvm+0x887/0xe00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 >>> > kvm_vm_release+0x42/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:759 >>> > __fput+0x301/0x7e0 fs/file_table.c:210 >>> > ____fput+0x15/0x20 fs/file_table.c:244 >>> > task_work_run+0x19e/0x250 kernel/task_work.c:112 >>> > exit_task_work include/linux/task_work.h:21 [inline] >>> > do_exit+0x99f/0x18b0 kernel/exit.c:865 >>> > do_group_exit+0x14b/0x3f0 kernel/exit.c:968 >>> > SYSC_exit_group kernel/exit.c:979 [inline] >>> > SyS_exit_group+0x1d/0x20 kernel/exit.c:977 >>> > entry_SYSCALL_64_fastpath+0x1f/0xbe >>> > RIP: 0033:0x443849 >>> > RSP: 002b:00007ffe58a95c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 >>> > RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443849 >>> > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 >>> > RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7 >>> > R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000 >>> > R13: 0000000000404800 R14: 0000000000404890 R15: 0000000000000000 >>> > Code: 0f 1f 80 00 00 00 00 55 48 89 e5 0f 20 d8 5d c3 0f 1f 80 00 00 >>> > 00 00 55 48 89 e5 0f 22 df 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 <0f> >>> > 22 e7 5d c3 0f 1f 80 00 00 00 00 55 48 89 e5 44 0f 20 c0 5d >>> > RIP: native_write_cr4+0x4/0x10 arch/x86/include/asm/special_insns.h:75 >>> > RSP: ffff88006671f598 >>> > ---[ end trace 6f9dbcc14aa47936 ]--- ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2017-11-06 9:52 UTC | newest] Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2017-10-31 9:59 kvm: GPF in native_write_cr4 Dmitry Vyukov 2017-10-31 10:05 ` Wanpeng Li 2017-10-31 11:10 ` Wanpeng Li 2017-10-31 11:24 ` Dmitry Vyukov 2017-10-31 11:25 ` Dmitry Vyukov 2017-10-31 12:53 ` Haozhong Zhang 2017-10-31 13:07 ` Dmitry Vyukov 2017-11-06 9:48 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).