From: Dmitry Vyukov <dvyukov@google.com>
To: Gleb Natapov <gleb@kernel.org>,
Paolo Bonzini <pbonzini@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
"x86@kernel.org" <x86@kernel.org>,
kvm@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
mtosatti@redhat.com, yoshikawa_takuya_b1@lab.ntt.co.jp,
guangrong.xiao@linux.intel.com
Cc: syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Eric Dumazet <edumazet@google.com>,
Sasha Levin <sasha.levin@oracle.com>
Subject: Re: kvm: WARNING in kvm_apic_accept_events
Date: Fri, 15 Jan 2016 18:13:00 +0100 [thread overview]
Message-ID: <CACT4Y+ZvsvyAxuVvVD6V6jMsa=eB5Go_vzpa_jczY1Vdo2U54Q@mail.gmail.com> (raw)
In-Reply-To: <CACT4Y+ZQLUPzUX6Bbn4x3b83qrHfbR81srYZkfEVfB8rE4c3eg@mail.gmail.com>
On Fri, Jan 8, 2016 at 6:16 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following program triggers WARNING in kvm_apic_accept_events:
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <unistd.h>
> #include <sys/syscall.h>
> #include <string.h>
> #include <stdint.h>
>
> long r[32];
>
> int main()
> {
> memset(r, -1, sizeof(r));
> r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
> memcpy((void*)0x20007000, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8);
> r[2] = syscall(SYS_open, 0x20007000ul, 0x801ul, 0x0ul, 0, 0, 0);
> r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
> *(uint64_t*)0x2000cbe8 = (uint64_t)0x2cf6;
> r[5] = syscall(SYS_ioctl, r[3], 0xae78ul, 0x2000cbe8ul, 0, 0, 0);
> r[6] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
> r[7] = syscall(SYS_ioctl, r[6], 0xae60ul, 0, 0, 0, 0);
> r[8] = syscall(SYS_ioctl, r[6], 0xae41ul, 0x0ul, 0, 0, 0);
> *(uint8_t*)0x20001f89 = (uint8_t)0xff5b;
> *(uint8_t*)0x20001f8a = (uint8_t)0x8;
> *(uint8_t*)0x20001f8b = (uint8_t)0x7;
> *(uint8_t*)0x20001f8c = (uint8_t)0x8;
> *(uint32_t*)0x20001f8d = (uint32_t)0x2;
> *(uint8_t*)0x20001f91 = (uint8_t)0xfffffffffffffff7;
> *(uint8_t*)0x20001f92 = (uint8_t)0x8;
> *(uint8_t*)0x20001f93 = (uint8_t)0x6;
> *(uint8_t*)0x20001f94 = (uint8_t)0x4e399187;
> *(uint8_t*)0x20001f95 = (uint8_t)0x28;
> *(uint8_t*)0x20001f96 = (uint8_t)0x5;
> *(uint8_t*)0x20001f97 = (uint8_t)0x7;
> *(uint8_t*)0x20001f98 = (uint8_t)0x4;
> *(uint32_t*)0x20001f99 = (uint32_t)0x4;
> *(uint32_t*)0x20001f9d = (uint32_t)0x8;
> *(uint8_t*)0x20001fa1 = (uint8_t)0x1;
> *(uint8_t*)0x20001fa2 = (uint8_t)0x4;
> *(uint8_t*)0x20001fa3 = (uint8_t)0x2;
> *(uint8_t*)0x20001fa4 = (uint8_t)0x5;
> r[28] = syscall(SYS_ioctl, r[8], 0x4040aea0ul, 0x20001f89ul, 0, 0, 0);
> *(uint32_t*)0x2000c000 = (uint32_t)0x2;
> r[30] = syscall(SYS_ioctl, r[8], 0x4004ae99ul, 0x2000c000ul, 0, 0, 0);
> r[31] = syscall(SYS_ioctl, r[8], 0xae80ul, 0, 0, 0, 0);
> return 0;
> }
>
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 6658 at arch/x86/kvm/lapic.c:2157
> kvm_apic_accept_events+0x3dd/0x440()
> Modules linked in:
> CPU: 1 PID: 6658 Comm: a.out Tainted: G W 4.4.0-rc8+ #216
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff88006c8bf990 ffffffff82904c8d 0000000000000000
> ffff8800624eaf00 ffffffff85ee24a0 ffff88006c8bf9d0 ffffffff8133e979
> ffffffff810d4f0d ffffffff85ee24a0 000000000000086d ffff88006571b608
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff82904c8d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> [<ffffffff8133e979>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:460
> [<ffffffff8133eba9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493
> [<ffffffff810d4f0d>] kvm_apic_accept_events+0x3dd/0x440
> arch/x86/kvm/lapic.c:2157
> [< inline >] vcpu_block arch/x86/kvm/x86.c:6627
> [< inline >] vcpu_run arch/x86/kvm/x86.c:6662
> [<ffffffff81068822>] kvm_arch_vcpu_ioctl_run+0xc32/0x5820
> arch/x86/kvm/x86.c:6818
> [<ffffffff8101cf61>] kvm_vcpu_ioctl+0x5f1/0xd00
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2375
> [< inline >] vfs_ioctl fs/ioctl.c:43
> [<ffffffff817b36b1>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
> [< inline >] SYSC_ioctl fs/ioctl.c:622
> [<ffffffff817b3eff>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
> [<ffffffff85e745b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
> ---[ end trace 231a97373e5bf4b0 ]---
>
>
> On commit b06f3a168cdcd80026276898fd1fee443ef25743 (Jan 6).
+ more kvm people
next prev parent reply other threads:[~2016-01-15 17:13 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-08 17:16 kvm: WARNING in kvm_apic_accept_events Dmitry Vyukov
2016-01-15 17:13 ` Dmitry Vyukov [this message]
2016-11-12 1:56 kvm: WARNING In kvm_apic_accept_events Dmitry Vyukov
2017-01-22 8:52 ` Dmitry Vyukov
2017-01-23 16:03 ` David Hildenbrand
2017-01-23 16:29 ` Paolo Bonzini
2017-02-14 20:31 ` Dmitry Vyukov
2017-02-15 9:26 ` David Hildenbrand
2017-02-15 10:10 ` Paolo Bonzini
2017-03-22 15:34 ` Dmitry Vyukov
2017-03-22 15:35 ` David Hildenbrand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CACT4Y+ZvsvyAxuVvVD6V6jMsa=eB5Go_vzpa_jczY1Vdo2U54Q@mail.gmail.com' \
--to=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=gleb@kernel.org \
--cc=glider@google.com \
--cc=guangrong.xiao@linux.intel.com \
--cc=hpa@zytor.com \
--cc=kcc@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=mtosatti@redhat.com \
--cc=pbonzini@redhat.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=yoshikawa_takuya_b1@lab.ntt.co.jp \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).