* kvm: WARNING in __x86_set_memory_region
@ 2016-11-12 1:52 Dmitry Vyukov
0 siblings, 0 replies; 3+ messages in thread
From: Dmitry Vyukov @ 2016-11-12 1:52 UTC (permalink / raw)
To: Paolo Bonzini, rkrcmar, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86, KVM list, LKML, Steve Rutherford
Cc: syzkaller
Hello,
The following program triggers WARNING in __x86_set_memory_region if
run in a loop:
https://gist.githubusercontent.com/dvyukov/efadb6b001717a896b0c281f85880988/raw/17dda56adba33020d8f3b89bd91363b60f49be24/gistfile1.txt
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
WARNING: CPU: 3 PID: 11295 at arch/x86/kvm/x86.c:7910
__x86_set_memory_region+0x43e/0x4e0
Kernel panic - not syncing: panic_on_warn set ...
CPU: 3 PID: 11295 Comm: syz-executor Not tainted 4.9.0-rc4+ #41
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88006753fb10 ffffffff81c2f79b ffffffff83271fc0 ffff88006753fbe8
ffffffff8321a100 ffffffff81094c2e ffff88006753fbd8 ffffffff81548463
0000000041b58ab3 ffffffff837cd50d ffffffff815482ac ffffffff815490e9
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff81c2f79b>] dump_stack+0xb3/0x118 lib/dump_stack.c:51
[<ffffffff81548463>] panic+0x1b7/0x3a3 kernel/panic.c:179
[<ffffffff81240014>] __warn+0x1c4/0x1e0 kernel/panic.c:542
[<ffffffff812401fc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
[<ffffffff81094c2e>] __x86_set_memory_region+0x43e/0x4e0
arch/x86/kvm/x86.c:7910
[<ffffffff81094d0e>] x86_set_memory_region+0x3e/0x60 arch/x86/kvm/x86.c:7922
[<ffffffff810b6a93>] kvm_arch_destroy_vm+0x523/0x620 arch/x86/kvm/x86.c:7939
[< inline >] kvm_destroy_vm
arch/x86/kvm/../../../virt/kvm/kvm_main.c:731
[<ffffffff810587ae>] kvm_put_kvm+0x40e/0x790
arch/x86/kvm/../../../virt/kvm/kvm_main.c:752
[<ffffffff81058c82>] kvm_vm_release+0x42/0x50
arch/x86/kvm/../../../virt/kvm/kvm_main.c:763
[<ffffffff81679239>] __fput+0x289/0x6f0 fs/file_table.c:208
[<ffffffff81679725>] ____fput+0x15/0x20 fs/file_table.c:244
[<ffffffff812a2999>] task_work_run+0xf9/0x170 kernel/task_work.c:116
[< inline >] tracehook_notify_resume include/linux/tracehook.h:191
[<ffffffff81003a26>] exit_to_usermode_loop+0x126/0x150
arch/x86/entry/common.c:160
[< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190
[<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0
arch/x86/entry/common.c:259
[<ffffffff831ebda2>] entry_SYSCALL_64_fastpath+0xc0/0xc2
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: kvm: WARNING in __x86_set_memory_region
2016-01-08 15:55 Dmitry Vyukov
@ 2016-01-15 17:13 ` Dmitry Vyukov
0 siblings, 0 replies; 3+ messages in thread
From: Dmitry Vyukov @ 2016-01-15 17:13 UTC (permalink / raw)
To: Gleb Natapov, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86, kvm, LKML, mtosatti, yoshikawa_takuya_b1,
guangrong.xiao
Cc: syzkaller, Kostya Serebryany, Alexander Potapenko, Eric Dumazet,
Sasha Levin
On Fri, Jan 8, 2016 at 4:55 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following program triggers WARNING in __x86_set_memory_region:
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <unistd.h>
> #include <sys/syscall.h>
> #include <string.h>
> #include <stdint.h>
>
> long r[8];
>
> int main()
> {
> memset(r, -1, sizeof(r));
> r[0] = syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
> memcpy((void*)0x20000000, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8);
> r[2] = syscall(SYS_open, 0x20000000ul, 0x200ul, 0x0ul, 0, 0, 0);
> r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
> *(uint64_t*)0x20000000 = (uint64_t)0x440;
> r[5] = syscall(SYS_ioctl, r[3], 0xae47ul, 0x20000000ul, 0, 0, 0);
> *(uint64_t*)0x20000000 = (uint64_t)0x1;
> r[7] = syscall(SYS_ioctl, r[3], 0xae47ul, 0x20000000ul, 0, 0, 0);
> return 0;
> }
>
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 7265 at arch/x86/kvm/x86.c:7703
> __x86_set_memory_region+0x4b9/0x500()
> Modules linked in:
> CPU: 3 PID: 7265 Comm: syz-executor Tainted: G W 4.4.0-rc8+ #211
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff8800351d7720 ffffffff82907ccd 0000000000000000
> ffff880033f81780 ffffffff85ed4540 ffff8800351d7760 ffffffff8133f979
> ffffffff8103d8a9 ffffffff85ed4540 0000000000001e17 00000000000001fd
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff82907ccd>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> [<ffffffff8133f979>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:460
> [<ffffffff8133fba9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493
> [<ffffffff8103d8a9>] __x86_set_memory_region+0x4b9/0x500
> arch/x86/kvm/x86.c:7703
> [<ffffffff8103d92e>] x86_set_memory_region+0x3e/0x60 arch/x86/kvm/x86.c:7749
> [<ffffffff810fc0f9>] vmx_set_tss_addr+0x79/0x2a0 arch/x86/kvm/vmx.c:5101
> [< inline >] kvm_vm_ioctl_set_tss_addr arch/x86/kvm/x86.c:3477
> [<ffffffff8105a90b>] kvm_arch_vm_ioctl+0xecb/0x1db0 arch/x86/kvm/x86.c:3744
> [<ffffffff8101ff4c>] kvm_vm_ioctl+0x17c/0xf30
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2902
> [< inline >] vfs_ioctl fs/ioctl.c:43
> [<ffffffff817b66f1>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
> [< inline >] SYSC_ioctl fs/ioctl.c:622
> [<ffffffff817b6f3f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
> [<ffffffff85e77af6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
> ---[ end trace 6d1cb7e02f836554 ]---
>
> On commit b06f3a168cdcd80026276898fd1fee443ef25743 (Jan 6).
+ more kvm people
^ permalink raw reply [flat|nested] 3+ messages in thread
* kvm: WARNING in __x86_set_memory_region
@ 2016-01-08 15:55 Dmitry Vyukov
2016-01-15 17:13 ` Dmitry Vyukov
0 siblings, 1 reply; 3+ messages in thread
From: Dmitry Vyukov @ 2016-01-08 15:55 UTC (permalink / raw)
To: Gleb Natapov, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86, kvm, LKML
Cc: syzkaller, Kostya Serebryany, Alexander Potapenko, Eric Dumazet,
Sasha Levin
Hello,
The following program triggers WARNING in __x86_set_memory_region:
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
long r[8];
int main()
{
memset(r, -1, sizeof(r));
r[0] = syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul,
0x32ul, 0xfffffffffffffffful, 0x0ul);
memcpy((void*)0x20000000, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8);
r[2] = syscall(SYS_open, 0x20000000ul, 0x200ul, 0x0ul, 0, 0, 0);
r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
*(uint64_t*)0x20000000 = (uint64_t)0x440;
r[5] = syscall(SYS_ioctl, r[3], 0xae47ul, 0x20000000ul, 0, 0, 0);
*(uint64_t*)0x20000000 = (uint64_t)0x1;
r[7] = syscall(SYS_ioctl, r[3], 0xae47ul, 0x20000000ul, 0, 0, 0);
return 0;
}
------------[ cut here ]------------
WARNING: CPU: 3 PID: 7265 at arch/x86/kvm/x86.c:7703
__x86_set_memory_region+0x4b9/0x500()
Modules linked in:
CPU: 3 PID: 7265 Comm: syz-executor Tainted: G W 4.4.0-rc8+ #211
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
00000000ffffffff ffff8800351d7720 ffffffff82907ccd 0000000000000000
ffff880033f81780 ffffffff85ed4540 ffff8800351d7760 ffffffff8133f979
ffffffff8103d8a9 ffffffff85ed4540 0000000000001e17 00000000000001fd
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff82907ccd>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
[<ffffffff8133f979>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:460
[<ffffffff8133fba9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493
[<ffffffff8103d8a9>] __x86_set_memory_region+0x4b9/0x500
arch/x86/kvm/x86.c:7703
[<ffffffff8103d92e>] x86_set_memory_region+0x3e/0x60 arch/x86/kvm/x86.c:7749
[<ffffffff810fc0f9>] vmx_set_tss_addr+0x79/0x2a0 arch/x86/kvm/vmx.c:5101
[< inline >] kvm_vm_ioctl_set_tss_addr arch/x86/kvm/x86.c:3477
[<ffffffff8105a90b>] kvm_arch_vm_ioctl+0xecb/0x1db0 arch/x86/kvm/x86.c:3744
[<ffffffff8101ff4c>] kvm_vm_ioctl+0x17c/0xf30
arch/x86/kvm/../../../virt/kvm/kvm_main.c:2902
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff817b66f1>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
[< inline >] SYSC_ioctl fs/ioctl.c:622
[<ffffffff817b6f3f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
[<ffffffff85e77af6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace 6d1cb7e02f836554 ]---
On commit b06f3a168cdcd80026276898fd1fee443ef25743 (Jan 6).
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-11-12 1:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-12 1:52 kvm: WARNING in __x86_set_memory_region Dmitry Vyukov
-- strict thread matches above, loose matches on Subject: below --
2016-01-08 15:55 Dmitry Vyukov
2016-01-15 17:13 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).