* kvm: GPF in irq_bypass_unregister_consumer
@ 2016-11-12 1:21 Dmitry Vyukov
2017-01-03 9:32 ` Dmitry Vyukov
0 siblings, 1 reply; 5+ messages in thread
From: Dmitry Vyukov @ 2016-11-12 1:21 UTC (permalink / raw)
To: Alex Williamson, Paolo Bonzini, KVM list, LKML, Steve Rutherford
Cc: syzkaller
Hello,
The following programs triggers GPF in irq_bypass_unregister_consumer
if run in a parallel loop:
https://gist.githubusercontent.com/dvyukov/0d18d7b11659187ec3eab22285b4a67e/raw/c1c622ca26ebce0c7b77e3200970ca0f7792cb32/gistfile1.txt
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 599 Comm: kworker/2:1 Not tainted 4.9.0-rc4+ #41
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: kvm-irqfd-cleanup irqfd_shutdown
task: ffff88006cb51700 task.stack: ffff88006cbd8000
RIP: 0010:[<ffffffff831d3957>] [< inline >] __list_del
include/linux/list.h:89
RIP: 0010:[<ffffffff831d3957>] [< inline >] list_del
include/linux/list.h:107
RIP: 0010:[<ffffffff831d3957>] [<ffffffff831d3957>]
irq_bypass_unregister_consumer+0x237/0x360 virt/lib/irqbypass.c:258
RSP: 0018:ffff88006cbdfb68 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88006cb51f00
RDX: 0000000000000001 RSI: ffff88006cb51f50 RDI: 0000000000000008
RBP: ffff88006cbdfb90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003caea638
R13: 0000000000000000 R14: ffffffff83ece9a0 R15: ffff88006bb0a530
FS: 0000000000000000(0000) GS:ffff88006e200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e0000 CR3: 0000000003a1d000 CR4: 00000000000026e0
Stack:
ffff88003caea4d0 ffff88003caea5f8 1ffff1000d97bf75 ffff88003caea5d0
dffffc0000000000 ffff88006cbdfc30 ffffffff8106d144 0000000000000000
0000000041b58ab3 ffffffff837c38d1 ffffffff8106d030 0000000000000246
Call Trace:
[<ffffffff8106d144>] irqfd_shutdown+0x114/0x1a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:145
[<ffffffff8129375c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096
[<ffffffff8129474f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230
[<ffffffff812a7a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
[<ffffffff831ebf6a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b7 00 00 00 49 8d 7d 08
48 b8 00 00 00 00 00 fc ff df 49 8b 5c 24 08 48 89 fa 48 c1 ea 03 <80>
3c 02 00 0f 85 9d 00 00 00 48 89 da 48 b8 00 00 00 00 00 fc
RIP [< inline >] __list_del include/linux/list.h:89
RIP [< inline >] list_del include/linux/list.h:107
RIP [<ffffffff831d3957>] irq_bypass_unregister_consumer+0x237/0x360
virt/lib/irqbypass.c:258
RSP <ffff88006cbdfb68>
---[ end trace 986ec3b53e4e0338 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: kvm: GPF in irq_bypass_unregister_consumer
2016-11-12 1:21 kvm: GPF in irq_bypass_unregister_consumer Dmitry Vyukov
@ 2017-01-03 9:32 ` Dmitry Vyukov
2017-01-04 4:36 ` Wanpeng Li
0 siblings, 1 reply; 5+ messages in thread
From: Dmitry Vyukov @ 2017-01-03 9:32 UTC (permalink / raw)
To: Alex Williamson, Paolo Bonzini, KVM list, LKML, Steve Rutherford
Cc: syzkaller
On Sat, Nov 12, 2016 at 2:21 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following programs triggers GPF in irq_bypass_unregister_consumer
> if run in a parallel loop:
> https://gist.githubusercontent.com/dvyukov/0d18d7b11659187ec3eab22285b4a67e/raw/c1c622ca26ebce0c7b77e3200970ca0f7792cb32/gistfile1.txt
>
> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>
> general protection fault: 0000 [#1] SMP KASAN
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Modules linked in:
> CPU: 2 PID: 599 Comm: kworker/2:1 Not tainted 4.9.0-rc4+ #41
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Workqueue: kvm-irqfd-cleanup irqfd_shutdown
> task: ffff88006cb51700 task.stack: ffff88006cbd8000
> RIP: 0010:[<ffffffff831d3957>] [< inline >] __list_del
> include/linux/list.h:89
> RIP: 0010:[<ffffffff831d3957>] [< inline >] list_del
> include/linux/list.h:107
> RIP: 0010:[<ffffffff831d3957>] [<ffffffff831d3957>]
> irq_bypass_unregister_consumer+0x237/0x360 virt/lib/irqbypass.c:258
> RSP: 0018:ffff88006cbdfb68 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88006cb51f00
> RDX: 0000000000000001 RSI: ffff88006cb51f50 RDI: 0000000000000008
> RBP: ffff88006cbdfb90 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003caea638
> R13: 0000000000000000 R14: ffffffff83ece9a0 R15: ffff88006bb0a530
> FS: 0000000000000000(0000) GS:ffff88006e200000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000006e0000 CR3: 0000000003a1d000 CR4: 00000000000026e0
> Stack:
> ffff88003caea4d0 ffff88003caea5f8 1ffff1000d97bf75 ffff88003caea5d0
> dffffc0000000000 ffff88006cbdfc30 ffffffff8106d144 0000000000000000
> 0000000041b58ab3 ffffffff837c38d1 ffffffff8106d030 0000000000000246
> Call Trace:
> [<ffffffff8106d144>] irqfd_shutdown+0x114/0x1a0
> arch/x86/kvm/../../../virt/kvm/eventfd.c:145
> [<ffffffff8129375c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096
> [<ffffffff8129474f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230
> [<ffffffff812a7a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
> [<ffffffff831ebf6a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
> Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b7 00 00 00 49 8d 7d 08
> 48 b8 00 00 00 00 00 fc ff df 49 8b 5c 24 08 48 89 fa 48 c1 ea 03 <80>
> 3c 02 00 0f 85 9d 00 00 00 48 89 da 48 b8 00 00 00 00 00 fc
> RIP [< inline >] __list_del include/linux/list.h:89
> RIP [< inline >] list_del include/linux/list.h:107
> RIP [<ffffffff831d3957>] irq_bypass_unregister_consumer+0x237/0x360
> virt/lib/irqbypass.c:258
> RSP <ffff88006cbdfb68>
> ---[ end trace 986ec3b53e4e0338 ]---
> Kernel panic - not syncing: Fatal exception
> Dumping ftrace buffer:
> (ftrace buffer empty)
> Kernel Offset: disabled
> reboot: cpu_has_vmx: ecx=80a02021 1
Still happens on c8b4ec8351d21da3299b045b37920e5cf5590793 (Jan 2).
[ 480.585892] irq bypass consumer (token ffff88003e205700)
registration fails: -16
[ 480.686218] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000008
[ 480.686868] IP: irq_bypass_unregister_consumer+0x8d/0xd0
[ 480.686993] PGD 0
[ 480.686993]
[ 480.686993] Oops: 0002 [#1] SMP
[ 480.686993] Modules linked in:
[ 480.686993] CPU: 3 PID: 585 Comm: kworker/3:1 Not tainted 4.10.0-rc2+ #57
[ 480.686993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS Bochs 01/01/2011
[ 480.686993] Workqueue: kvm-irqfd-cleanup irqfd_shutdown
[ 480.686993] task: ffff88007fa3a8c0 task.stack: ffffc90001524000
[ 480.686993] RIP: 0010:irq_bypass_unregister_consumer+0x8d/0xd0
[ 480.686993] RSP: 0018:ffffc90001527e20 EFLAGS: 00010246
[ 480.686993] RAX: 0000000000000000 RBX: ffff88007dfa5170 RCX: 0000000000000004
[ 480.686993] RDX: 0000000000000000 RSI: ffff88007dfa50e8 RDI: 0000000000000000
[ 480.686993] RBP: ffffc90001527e28 R08: 0000000000000004 R09: ffff88007fd171c0
[ 480.686993] R10: 0000006feb214fc0 R11: 0000000000000000 R12: ffff88007dfa5070
[ 480.686993] R13: ffff88007fd1e300 R14: 00000000000000c0 R15: ffff88007dfa5150
[ 480.686993] FS: 0000000000000000(0000) GS:ffff88007fd00000(0000)
knlGS:0000000000000000
[ 480.686993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 480.686993] CR2: 0000000000000008 CR3: 0000000001e0a000 CR4: 00000000000026e0
[ 480.686993] Call Trace:
[ 480.686993] irqfd_shutdown+0x52/0x70
[ 480.686993] process_one_work+0x149/0x3f0
[ 480.686993] worker_thread+0x126/0x4a0
[ 480.686993] ? __schedule+0x21c/0x660
[ 480.686993] kthread+0xfc/0x130
[ 480.686993] ? rescuer_thread+0x320/0x320
[ 480.686993] ? kthread_park+0x90/0x90
[ 480.686993] ret_from_fork+0x25/0x30
[ 480.686993] Code: 30 d7 f0 81 75 0e eb 1a 48 8b 3f 48 81 ff 30 d7
f0 81 74 0e 48 39 57 10 75 ee 48 89 de e8 cc fb ff ff 48 8b 43 08 48
8b 13 31 ff <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89
03 66
[ 480.686993] RIP: irq_bypass_unregister_consumer+0x8d/0xd0 RSP:
ffffc90001527e20
[ 480.686993] CR2: 0000000000000008
[ 480.686993] ---[ end trace e5a8ddcdf160fccb ]---
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: kvm: GPF in irq_bypass_unregister_consumer
2017-01-03 9:32 ` Dmitry Vyukov
@ 2017-01-04 4:36 ` Wanpeng Li
2017-01-04 8:58 ` Dmitry Vyukov
0 siblings, 1 reply; 5+ messages in thread
From: Wanpeng Li @ 2017-01-04 4:36 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: Alex Williamson, Paolo Bonzini, KVM list, LKML, Steve Rutherford,
syzkaller
2017-01-03 17:32 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>:
> On Sat, Nov 12, 2016 at 2:21 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
>> Hello,
>>
>> The following programs triggers GPF in irq_bypass_unregister_consumer
>> if run in a parallel loop:
>> https://gist.githubusercontent.com/dvyukov/0d18d7b11659187ec3eab22285b4a67e/raw/c1c622ca26ebce0c7b77e3200970ca0f7792cb32/gistfile1.txt
>>
>> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>>
>> general protection fault: 0000 [#1] SMP KASAN
>> Dumping ftrace buffer:
>> (ftrace buffer empty)
>> Modules linked in:
>> CPU: 2 PID: 599 Comm: kworker/2:1 Not tainted 4.9.0-rc4+ #41
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>> Workqueue: kvm-irqfd-cleanup irqfd_shutdown
>> task: ffff88006cb51700 task.stack: ffff88006cbd8000
>> RIP: 0010:[<ffffffff831d3957>] [< inline >] __list_del
>> include/linux/list.h:89
>> RIP: 0010:[<ffffffff831d3957>] [< inline >] list_del
>> include/linux/list.h:107
>> RIP: 0010:[<ffffffff831d3957>] [<ffffffff831d3957>]
>> irq_bypass_unregister_consumer+0x237/0x360 virt/lib/irqbypass.c:258
>> RSP: 0018:ffff88006cbdfb68 EFLAGS: 00010202
>> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88006cb51f00
>> RDX: 0000000000000001 RSI: ffff88006cb51f50 RDI: 0000000000000008
>> RBP: ffff88006cbdfb90 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003caea638
>> R13: 0000000000000000 R14: ffffffff83ece9a0 R15: ffff88006bb0a530
>> FS: 0000000000000000(0000) GS:ffff88006e200000(0000) knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00000000006e0000 CR3: 0000000003a1d000 CR4: 00000000000026e0
>> Stack:
>> ffff88003caea4d0 ffff88003caea5f8 1ffff1000d97bf75 ffff88003caea5d0
>> dffffc0000000000 ffff88006cbdfc30 ffffffff8106d144 0000000000000000
>> 0000000041b58ab3 ffffffff837c38d1 ffffffff8106d030 0000000000000246
>> Call Trace:
>> [<ffffffff8106d144>] irqfd_shutdown+0x114/0x1a0
>> arch/x86/kvm/../../../virt/kvm/eventfd.c:145
>> [<ffffffff8129375c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096
>> [<ffffffff8129474f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230
>> [<ffffffff812a7a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
>> [<ffffffff831ebf6a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
>> Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b7 00 00 00 49 8d 7d 08
>> 48 b8 00 00 00 00 00 fc ff df 49 8b 5c 24 08 48 89 fa 48 c1 ea 03 <80>
>> 3c 02 00 0f 85 9d 00 00 00 48 89 da 48 b8 00 00 00 00 00 fc
>> RIP [< inline >] __list_del include/linux/list.h:89
>> RIP [< inline >] list_del include/linux/list.h:107
>> RIP [<ffffffff831d3957>] irq_bypass_unregister_consumer+0x237/0x360
>> virt/lib/irqbypass.c:258
>> RSP <ffff88006cbdfb68>
>> ---[ end trace 986ec3b53e4e0338 ]---
>> Kernel panic - not syncing: Fatal exception
>> Dumping ftrace buffer:
>> (ftrace buffer empty)
>> Kernel Offset: disabled
>> reboot: cpu_has_vmx: ecx=80a02021 1
>
>
> Still happens on c8b4ec8351d21da3299b045b37920e5cf5590793 (Jan 2).
>
> [ 480.585892] irq bypass consumer (token ffff88003e205700)
> registration fails: -16
> [ 480.686218] BUG: unable to handle kernel NULL pointer dereference
> at 0000000000000008
> [ 480.686868] IP: irq_bypass_unregister_consumer+0x8d/0xd0
> [ 480.686993] PGD 0
> [ 480.686993]
> [ 480.686993] Oops: 0002 [#1] SMP
> [ 480.686993] Modules linked in:
> [ 480.686993] CPU: 3 PID: 585 Comm: kworker/3:1 Not tainted 4.10.0-rc2+ #57
> [ 480.686993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS Bochs 01/01/2011
> [ 480.686993] Workqueue: kvm-irqfd-cleanup irqfd_shutdown
> [ 480.686993] task: ffff88007fa3a8c0 task.stack: ffffc90001524000
> [ 480.686993] RIP: 0010:irq_bypass_unregister_consumer+0x8d/0xd0
> [ 480.686993] RSP: 0018:ffffc90001527e20 EFLAGS: 00010246
> [ 480.686993] RAX: 0000000000000000 RBX: ffff88007dfa5170 RCX: 0000000000000004
> [ 480.686993] RDX: 0000000000000000 RSI: ffff88007dfa50e8 RDI: 0000000000000000
> [ 480.686993] RBP: ffffc90001527e28 R08: 0000000000000004 R09: ffff88007fd171c0
> [ 480.686993] R10: 0000006feb214fc0 R11: 0000000000000000 R12: ffff88007dfa5070
> [ 480.686993] R13: ffff88007fd1e300 R14: 00000000000000c0 R15: ffff88007dfa5150
> [ 480.686993] FS: 0000000000000000(0000) GS:ffff88007fd00000(0000)
> knlGS:0000000000000000
> [ 480.686993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 480.686993] CR2: 0000000000000008 CR3: 0000000001e0a000 CR4: 00000000000026e0
> [ 480.686993] Call Trace:
> [ 480.686993] irqfd_shutdown+0x52/0x70
> [ 480.686993] process_one_work+0x149/0x3f0
> [ 480.686993] worker_thread+0x126/0x4a0
> [ 480.686993] ? __schedule+0x21c/0x660
> [ 480.686993] kthread+0xfc/0x130
> [ 480.686993] ? rescuer_thread+0x320/0x320
> [ 480.686993] ? kthread_park+0x90/0x90
> [ 480.686993] ret_from_fork+0x25/0x30
> [ 480.686993] Code: 30 d7 f0 81 75 0e eb 1a 48 8b 3f 48 81 ff 30 d7
> f0 81 74 0e 48 39 57 10 75 ee 48 89 de e8 cc fb ff ff 48 8b 43 08 48
> 8b 13 31 ff <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89
> 03 66
> [ 480.686993] RIP: irq_bypass_unregister_consumer+0x8d/0xd0 RSP:
> ffffc90001527e20
> [ 480.686993] CR2: 0000000000000008
> [ 480.686993] ---[ end trace e5a8ddcdf160fccb ]---
case 1:
r[2] = syscall(__NR_open, "/dev/kvm", 0x40042ul, 0, 0, 0, 0, 0, 0);
break;
case 2:
r[3] = execute_syscall(__NR_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0,
0, 0, 0);
break;
case 3:
r[4] = execute_syscall(__NR_ioctl, r[3], 0xae41ul, 0x3fful, 0, 0, 0,
0, 0, 0);
break;
case 4:
r[5] = execute_syscall(__NR_ioctl, r[4], 0xae9aul, 0, 0, 0, 0, 0, 0,
0);
break;
case 5:
r[6] = execute_syscall(__NR_eventfd2, 0x8ul, 0x801ul, 0, 0, 0, 0, 0,
0, 0);
What's the meaning of parameter "0x40042ul", “0xae01ul” etc here?
Regards,
Wanpeng Li
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: kvm: GPF in irq_bypass_unregister_consumer
2017-01-04 4:36 ` Wanpeng Li
@ 2017-01-04 8:58 ` Dmitry Vyukov
2017-01-04 9:11 ` Wanpeng Li
0 siblings, 1 reply; 5+ messages in thread
From: Dmitry Vyukov @ 2017-01-04 8:58 UTC (permalink / raw)
To: Wanpeng Li
Cc: Alex Williamson, Paolo Bonzini, KVM list, LKML, Steve Rutherford,
syzkaller
On Wed, Jan 4, 2017 at 5:36 AM, Wanpeng Li <kernellwp@gmail.com> wrote:
> 2017-01-03 17:32 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>:
>> On Sat, Nov 12, 2016 at 2:21 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
>>> Hello,
>>>
>>> The following programs triggers GPF in irq_bypass_unregister_consumer
>>> if run in a parallel loop:
>>> https://gist.githubusercontent.com/dvyukov/0d18d7b11659187ec3eab22285b4a67e/raw/c1c622ca26ebce0c7b77e3200970ca0f7792cb32/gistfile1.txt
>>>
>>> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>>>
>>> general protection fault: 0000 [#1] SMP KASAN
>>> Dumping ftrace buffer:
>>> (ftrace buffer empty)
>>> Modules linked in:
>>> CPU: 2 PID: 599 Comm: kworker/2:1 Not tainted 4.9.0-rc4+ #41
>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>>> Workqueue: kvm-irqfd-cleanup irqfd_shutdown
>>> task: ffff88006cb51700 task.stack: ffff88006cbd8000
>>> RIP: 0010:[<ffffffff831d3957>] [< inline >] __list_del
>>> include/linux/list.h:89
>>> RIP: 0010:[<ffffffff831d3957>] [< inline >] list_del
>>> include/linux/list.h:107
>>> RIP: 0010:[<ffffffff831d3957>] [<ffffffff831d3957>]
>>> irq_bypass_unregister_consumer+0x237/0x360 virt/lib/irqbypass.c:258
>>> RSP: 0018:ffff88006cbdfb68 EFLAGS: 00010202
>>> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88006cb51f00
>>> RDX: 0000000000000001 RSI: ffff88006cb51f50 RDI: 0000000000000008
>>> RBP: ffff88006cbdfb90 R08: 0000000000000000 R09: 0000000000000000
>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003caea638
>>> R13: 0000000000000000 R14: ffffffff83ece9a0 R15: ffff88006bb0a530
>>> FS: 0000000000000000(0000) GS:ffff88006e200000(0000) knlGS:0000000000000000
>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> CR2: 00000000006e0000 CR3: 0000000003a1d000 CR4: 00000000000026e0
>>> Stack:
>>> ffff88003caea4d0 ffff88003caea5f8 1ffff1000d97bf75 ffff88003caea5d0
>>> dffffc0000000000 ffff88006cbdfc30 ffffffff8106d144 0000000000000000
>>> 0000000041b58ab3 ffffffff837c38d1 ffffffff8106d030 0000000000000246
>>> Call Trace:
>>> [<ffffffff8106d144>] irqfd_shutdown+0x114/0x1a0
>>> arch/x86/kvm/../../../virt/kvm/eventfd.c:145
>>> [<ffffffff8129375c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096
>>> [<ffffffff8129474f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230
>>> [<ffffffff812a7a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
>>> [<ffffffff831ebf6a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
>>> Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b7 00 00 00 49 8d 7d 08
>>> 48 b8 00 00 00 00 00 fc ff df 49 8b 5c 24 08 48 89 fa 48 c1 ea 03 <80>
>>> 3c 02 00 0f 85 9d 00 00 00 48 89 da 48 b8 00 00 00 00 00 fc
>>> RIP [< inline >] __list_del include/linux/list.h:89
>>> RIP [< inline >] list_del include/linux/list.h:107
>>> RIP [<ffffffff831d3957>] irq_bypass_unregister_consumer+0x237/0x360
>>> virt/lib/irqbypass.c:258
>>> RSP <ffff88006cbdfb68>
>>> ---[ end trace 986ec3b53e4e0338 ]---
>>> Kernel panic - not syncing: Fatal exception
>>> Dumping ftrace buffer:
>>> (ftrace buffer empty)
>>> Kernel Offset: disabled
>>> reboot: cpu_has_vmx: ecx=80a02021 1
>>
>>
>> Still happens on c8b4ec8351d21da3299b045b37920e5cf5590793 (Jan 2).
>>
>> [ 480.585892] irq bypass consumer (token ffff88003e205700)
>> registration fails: -16
>> [ 480.686218] BUG: unable to handle kernel NULL pointer dereference
>> at 0000000000000008
>> [ 480.686868] IP: irq_bypass_unregister_consumer+0x8d/0xd0
>> [ 480.686993] PGD 0
>> [ 480.686993]
>> [ 480.686993] Oops: 0002 [#1] SMP
>> [ 480.686993] Modules linked in:
>> [ 480.686993] CPU: 3 PID: 585 Comm: kworker/3:1 Not tainted 4.10.0-rc2+ #57
>> [ 480.686993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
>> BIOS Bochs 01/01/2011
>> [ 480.686993] Workqueue: kvm-irqfd-cleanup irqfd_shutdown
>> [ 480.686993] task: ffff88007fa3a8c0 task.stack: ffffc90001524000
>> [ 480.686993] RIP: 0010:irq_bypass_unregister_consumer+0x8d/0xd0
>> [ 480.686993] RSP: 0018:ffffc90001527e20 EFLAGS: 00010246
>> [ 480.686993] RAX: 0000000000000000 RBX: ffff88007dfa5170 RCX: 0000000000000004
>> [ 480.686993] RDX: 0000000000000000 RSI: ffff88007dfa50e8 RDI: 0000000000000000
>> [ 480.686993] RBP: ffffc90001527e28 R08: 0000000000000004 R09: ffff88007fd171c0
>> [ 480.686993] R10: 0000006feb214fc0 R11: 0000000000000000 R12: ffff88007dfa5070
>> [ 480.686993] R13: ffff88007fd1e300 R14: 00000000000000c0 R15: ffff88007dfa5150
>> [ 480.686993] FS: 0000000000000000(0000) GS:ffff88007fd00000(0000)
>> knlGS:0000000000000000
>> [ 480.686993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 480.686993] CR2: 0000000000000008 CR3: 0000000001e0a000 CR4: 00000000000026e0
>> [ 480.686993] Call Trace:
>> [ 480.686993] irqfd_shutdown+0x52/0x70
>> [ 480.686993] process_one_work+0x149/0x3f0
>> [ 480.686993] worker_thread+0x126/0x4a0
>> [ 480.686993] ? __schedule+0x21c/0x660
>> [ 480.686993] kthread+0xfc/0x130
>> [ 480.686993] ? rescuer_thread+0x320/0x320
>> [ 480.686993] ? kthread_park+0x90/0x90
>> [ 480.686993] ret_from_fork+0x25/0x30
>> [ 480.686993] Code: 30 d7 f0 81 75 0e eb 1a 48 8b 3f 48 81 ff 30 d7
>> f0 81 74 0e 48 39 57 10 75 ee 48 89 de e8 cc fb ff ff 48 8b 43 08 48
>> 8b 13 31 ff <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89
>> 03 66
>> [ 480.686993] RIP: irq_bypass_unregister_consumer+0x8d/0xd0 RSP:
>> ffffc90001527e20
>> [ 480.686993] CR2: 0000000000000008
>> [ 480.686993] ---[ end trace e5a8ddcdf160fccb ]---
>
>
> case 1:
> r[2] = syscall(__NR_open, "/dev/kvm", 0x40042ul, 0, 0, 0, 0, 0, 0);
> break;
> case 2:
> r[3] = execute_syscall(__NR_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0,
> 0, 0, 0);
> break;
> case 3:
> r[4] = execute_syscall(__NR_ioctl, r[3], 0xae41ul, 0x3fful, 0, 0, 0,
> 0, 0, 0);
> break;
> case 4:
> r[5] = execute_syscall(__NR_ioctl, r[4], 0xae9aul, 0, 0, 0, 0, 0, 0,
> 0);
> break;
> case 5:
> r[6] = execute_syscall(__NR_eventfd2, 0x8ul, 0x801ul, 0, 0, 0, 0, 0,
> 0, 0);
>
> What's the meaning of parameter "0x40042ul", “0xae01ul” etc here?
strace can shed some light on it:
$ strace -f -e ioctl ./a.out
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: kvm: GPF in irq_bypass_unregister_consumer
2017-01-04 8:58 ` Dmitry Vyukov
@ 2017-01-04 9:11 ` Wanpeng Li
0 siblings, 0 replies; 5+ messages in thread
From: Wanpeng Li @ 2017-01-04 9:11 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: Alex Williamson, Paolo Bonzini, KVM list, LKML, Steve Rutherford,
syzkaller
2017-01-04 16:58 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>:
> On Wed, Jan 4, 2017 at 5:36 AM, Wanpeng Li <kernellwp@gmail.com> wrote:
>> 2017-01-03 17:32 GMT+08:00 Dmitry Vyukov <dvyukov@google.com>:
>>> On Sat, Nov 12, 2016 at 2:21 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
>>>> Hello,
>>>>
>>>> The following programs triggers GPF in irq_bypass_unregister_consumer
>>>> if run in a parallel loop:
>>>> https://gist.githubusercontent.com/dvyukov/0d18d7b11659187ec3eab22285b4a67e/raw/c1c622ca26ebce0c7b77e3200970ca0f7792cb32/gistfile1.txt
>>>>
>>>> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
>>>>
>>>> general protection fault: 0000 [#1] SMP KASAN
>>>> Dumping ftrace buffer:
>>>> (ftrace buffer empty)
>>>> Modules linked in:
>>>> CPU: 2 PID: 599 Comm: kworker/2:1 Not tainted 4.9.0-rc4+ #41
>>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>>>> Workqueue: kvm-irqfd-cleanup irqfd_shutdown
>>>> task: ffff88006cb51700 task.stack: ffff88006cbd8000
>>>> RIP: 0010:[<ffffffff831d3957>] [< inline >] __list_del
>>>> include/linux/list.h:89
>>>> RIP: 0010:[<ffffffff831d3957>] [< inline >] list_del
>>>> include/linux/list.h:107
>>>> RIP: 0010:[<ffffffff831d3957>] [<ffffffff831d3957>]
>>>> irq_bypass_unregister_consumer+0x237/0x360 virt/lib/irqbypass.c:258
>>>> RSP: 0018:ffff88006cbdfb68 EFLAGS: 00010202
>>>> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88006cb51f00
>>>> RDX: 0000000000000001 RSI: ffff88006cb51f50 RDI: 0000000000000008
>>>> RBP: ffff88006cbdfb90 R08: 0000000000000000 R09: 0000000000000000
>>>> R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003caea638
>>>> R13: 0000000000000000 R14: ffffffff83ece9a0 R15: ffff88006bb0a530
>>>> FS: 0000000000000000(0000) GS:ffff88006e200000(0000) knlGS:0000000000000000
>>>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>> CR2: 00000000006e0000 CR3: 0000000003a1d000 CR4: 00000000000026e0
>>>> Stack:
>>>> ffff88003caea4d0 ffff88003caea5f8 1ffff1000d97bf75 ffff88003caea5d0
>>>> dffffc0000000000 ffff88006cbdfc30 ffffffff8106d144 0000000000000000
>>>> 0000000041b58ab3 ffffffff837c38d1 ffffffff8106d030 0000000000000246
>>>> Call Trace:
>>>> [<ffffffff8106d144>] irqfd_shutdown+0x114/0x1a0
>>>> arch/x86/kvm/../../../virt/kvm/eventfd.c:145
>>>> [<ffffffff8129375c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096
>>>> [<ffffffff8129474f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230
>>>> [<ffffffff812a7a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
>>>> [<ffffffff831ebf6a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
>>>> Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b7 00 00 00 49 8d 7d 08
>>>> 48 b8 00 00 00 00 00 fc ff df 49 8b 5c 24 08 48 89 fa 48 c1 ea 03 <80>
>>>> 3c 02 00 0f 85 9d 00 00 00 48 89 da 48 b8 00 00 00 00 00 fc
>>>> RIP [< inline >] __list_del include/linux/list.h:89
>>>> RIP [< inline >] list_del include/linux/list.h:107
>>>> RIP [<ffffffff831d3957>] irq_bypass_unregister_consumer+0x237/0x360
>>>> virt/lib/irqbypass.c:258
>>>> RSP <ffff88006cbdfb68>
>>>> ---[ end trace 986ec3b53e4e0338 ]---
>>>> Kernel panic - not syncing: Fatal exception
>>>> Dumping ftrace buffer:
>>>> (ftrace buffer empty)
>>>> Kernel Offset: disabled
>>>> reboot: cpu_has_vmx: ecx=80a02021 1
>>>
>>>
>>> Still happens on c8b4ec8351d21da3299b045b37920e5cf5590793 (Jan 2).
>>>
>>> [ 480.585892] irq bypass consumer (token ffff88003e205700)
>>> registration fails: -16
>>> [ 480.686218] BUG: unable to handle kernel NULL pointer dereference
>>> at 0000000000000008
>>> [ 480.686868] IP: irq_bypass_unregister_consumer+0x8d/0xd0
>>> [ 480.686993] PGD 0
>>> [ 480.686993]
>>> [ 480.686993] Oops: 0002 [#1] SMP
>>> [ 480.686993] Modules linked in:
>>> [ 480.686993] CPU: 3 PID: 585 Comm: kworker/3:1 Not tainted 4.10.0-rc2+ #57
>>> [ 480.686993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
>>> BIOS Bochs 01/01/2011
>>> [ 480.686993] Workqueue: kvm-irqfd-cleanup irqfd_shutdown
>>> [ 480.686993] task: ffff88007fa3a8c0 task.stack: ffffc90001524000
>>> [ 480.686993] RIP: 0010:irq_bypass_unregister_consumer+0x8d/0xd0
>>> [ 480.686993] RSP: 0018:ffffc90001527e20 EFLAGS: 00010246
>>> [ 480.686993] RAX: 0000000000000000 RBX: ffff88007dfa5170 RCX: 0000000000000004
>>> [ 480.686993] RDX: 0000000000000000 RSI: ffff88007dfa50e8 RDI: 0000000000000000
>>> [ 480.686993] RBP: ffffc90001527e28 R08: 0000000000000004 R09: ffff88007fd171c0
>>> [ 480.686993] R10: 0000006feb214fc0 R11: 0000000000000000 R12: ffff88007dfa5070
>>> [ 480.686993] R13: ffff88007fd1e300 R14: 00000000000000c0 R15: ffff88007dfa5150
>>> [ 480.686993] FS: 0000000000000000(0000) GS:ffff88007fd00000(0000)
>>> knlGS:0000000000000000
>>> [ 480.686993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [ 480.686993] CR2: 0000000000000008 CR3: 0000000001e0a000 CR4: 00000000000026e0
>>> [ 480.686993] Call Trace:
>>> [ 480.686993] irqfd_shutdown+0x52/0x70
>>> [ 480.686993] process_one_work+0x149/0x3f0
>>> [ 480.686993] worker_thread+0x126/0x4a0
>>> [ 480.686993] ? __schedule+0x21c/0x660
>>> [ 480.686993] kthread+0xfc/0x130
>>> [ 480.686993] ? rescuer_thread+0x320/0x320
>>> [ 480.686993] ? kthread_park+0x90/0x90
>>> [ 480.686993] ret_from_fork+0x25/0x30
>>> [ 480.686993] Code: 30 d7 f0 81 75 0e eb 1a 48 8b 3f 48 81 ff 30 d7
>>> f0 81 74 0e 48 39 57 10 75 ee 48 89 de e8 cc fb ff ff 48 8b 43 08 48
>>> 8b 13 31 ff <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89
>>> 03 66
>>> [ 480.686993] RIP: irq_bypass_unregister_consumer+0x8d/0xd0 RSP:
>>> ffffc90001527e20
>>> [ 480.686993] CR2: 0000000000000008
>>> [ 480.686993] ---[ end trace e5a8ddcdf160fccb ]---
>>
>>
>> case 1:
>> r[2] = syscall(__NR_open, "/dev/kvm", 0x40042ul, 0, 0, 0, 0, 0, 0);
>> break;
>> case 2:
>> r[3] = execute_syscall(__NR_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0,
>> 0, 0, 0);
>> break;
>> case 3:
>> r[4] = execute_syscall(__NR_ioctl, r[3], 0xae41ul, 0x3fful, 0, 0, 0,
>> 0, 0, 0);
>> break;
>> case 4:
>> r[5] = execute_syscall(__NR_ioctl, r[4], 0xae9aul, 0, 0, 0, 0, 0, 0,
>> 0);
>> break;
>> case 5:
>> r[6] = execute_syscall(__NR_eventfd2, 0x8ul, 0x801ul, 0, 0, 0, 0, 0,
>> 0, 0);
>>
>> What's the meaning of parameter "0x40042ul", “0xae01ul” etc here?
>
>
> strace can shed some light on it:
> $ strace -f -e ioctl ./a.out
Thanks, I will look into this report.
Regards,
Wanpeng Li
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-01-04 9:11 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-12 1:21 kvm: GPF in irq_bypass_unregister_consumer Dmitry Vyukov
2017-01-03 9:32 ` Dmitry Vyukov
2017-01-04 4:36 ` Wanpeng Li
2017-01-04 8:58 ` Dmitry Vyukov
2017-01-04 9:11 ` Wanpeng Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).