From: Dmitry Vyukov <dvyukov@google.com>
To: Gleb Natapov <gleb@kernel.org>,
Paolo Bonzini <pbonzini@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
"x86@kernel.org" <x86@kernel.org>,
kvm@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
mtosatti@redhat.com, yoshikawa_takuya_b1@lab.ntt.co.jp,
guangrong.xiao@linux.intel.com
Cc: syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Eric Dumazet <edumazet@google.com>,
Sasha Levin <sasha.levin@oracle.com>
Subject: Re: kvm: WARNING in __x86_set_memory_region
Date: Fri, 15 Jan 2016 18:13:28 +0100 [thread overview]
Message-ID: <CACT4Y+ayFpHd5SH_UNhXwoJPp28qTG-XJ-NSaDQX5YKoQMJGuw@mail.gmail.com> (raw)
In-Reply-To: <CACT4Y+YtmLqY=J4xtxF=kX7RJChp1eFffzyWXWwsF-nBjSdNqw@mail.gmail.com>
On Fri, Jan 8, 2016 at 4:55 PM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following program triggers WARNING in __x86_set_memory_region:
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <unistd.h>
> #include <sys/syscall.h>
> #include <string.h>
> #include <stdint.h>
>
> long r[8];
>
> int main()
> {
> memset(r, -1, sizeof(r));
> r[0] = syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul,
> 0x32ul, 0xfffffffffffffffful, 0x0ul);
> memcpy((void*)0x20000000, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8);
> r[2] = syscall(SYS_open, 0x20000000ul, 0x200ul, 0x0ul, 0, 0, 0);
> r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
> *(uint64_t*)0x20000000 = (uint64_t)0x440;
> r[5] = syscall(SYS_ioctl, r[3], 0xae47ul, 0x20000000ul, 0, 0, 0);
> *(uint64_t*)0x20000000 = (uint64_t)0x1;
> r[7] = syscall(SYS_ioctl, r[3], 0xae47ul, 0x20000000ul, 0, 0, 0);
> return 0;
> }
>
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 7265 at arch/x86/kvm/x86.c:7703
> __x86_set_memory_region+0x4b9/0x500()
> Modules linked in:
> CPU: 3 PID: 7265 Comm: syz-executor Tainted: G W 4.4.0-rc8+ #211
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff8800351d7720 ffffffff82907ccd 0000000000000000
> ffff880033f81780 ffffffff85ed4540 ffff8800351d7760 ffffffff8133f979
> ffffffff8103d8a9 ffffffff85ed4540 0000000000001e17 00000000000001fd
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff82907ccd>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> [<ffffffff8133f979>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:460
> [<ffffffff8133fba9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:493
> [<ffffffff8103d8a9>] __x86_set_memory_region+0x4b9/0x500
> arch/x86/kvm/x86.c:7703
> [<ffffffff8103d92e>] x86_set_memory_region+0x3e/0x60 arch/x86/kvm/x86.c:7749
> [<ffffffff810fc0f9>] vmx_set_tss_addr+0x79/0x2a0 arch/x86/kvm/vmx.c:5101
> [< inline >] kvm_vm_ioctl_set_tss_addr arch/x86/kvm/x86.c:3477
> [<ffffffff8105a90b>] kvm_arch_vm_ioctl+0xecb/0x1db0 arch/x86/kvm/x86.c:3744
> [<ffffffff8101ff4c>] kvm_vm_ioctl+0x17c/0xf30
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:2902
> [< inline >] vfs_ioctl fs/ioctl.c:43
> [<ffffffff817b66f1>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607
> [< inline >] SYSC_ioctl fs/ioctl.c:622
> [<ffffffff817b6f3f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613
> [<ffffffff85e77af6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
> ---[ end trace 6d1cb7e02f836554 ]---
>
> On commit b06f3a168cdcd80026276898fd1fee443ef25743 (Jan 6).
+ more kvm people
next prev parent reply other threads:[~2016-01-15 17:13 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-08 15:55 kvm: WARNING in __x86_set_memory_region Dmitry Vyukov
2016-01-15 17:13 ` Dmitry Vyukov [this message]
2016-11-12 1:52 Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CACT4Y+ayFpHd5SH_UNhXwoJPp28qTG-XJ-NSaDQX5YKoQMJGuw@mail.gmail.com \
--to=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=gleb@kernel.org \
--cc=glider@google.com \
--cc=guangrong.xiao@linux.intel.com \
--cc=hpa@zytor.com \
--cc=kcc@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=mtosatti@redhat.com \
--cc=pbonzini@redhat.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=yoshikawa_takuya_b1@lab.ntt.co.jp \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).