From: Joerg Roedel <joro@8bytes.org>
To: Alex Williamson <alex.williamson@redhat.com>
Cc: linux-kernel@vger.kernel.org, iommu@lists.linux-foundation.org,
kvm@vger.kernel.org
Subject: BUG: unable to handle kernel paging request with v4.3-rc4
Date: Fri, 9 Oct 2015 16:58:27 +0200 [thread overview]
Message-ID: <20151009145827.GB27420@8bytes.org> (raw)
Hi Alex,
while playing around with attaching a 32bit PCI device to a guest via
VFIO I triggered this oops:
[ 192.289917] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[ 192.298245] BUG: unable to handle kernel paging request at ffff880224582608
[ 192.306195] IP: [<ffff880224582608>] 0xffff880224582608
[ 192.312302] PGD 2026067 PUD 2029067 PMD 80000002244001e3
[ 192.318589] Oops: 0011 [#1] PREEMPT SMP
[ 192.323363] Modules linked in: kvm_amd kvm vfio_pci vfio_iommu_type1 vfio_virqfd vfio bnep bluetooth rfkill iscsi_ibft iscsi_boot_sysfs af_packet snd_hda_codec_via snd_hda_codec_generic snd_hda_codec_hdmi raid1 snd_hda_intel crct10dif_pclmul crc32_pclmul snd_hda_codec crc32c_intel ghash_clmulni_intel snd_hwdep snd_hda_core snd_pcm snd_timer aesni_intel aes_x86_64 md_mod glue_helper lrw gf128mul ablk_helper be2net snd serio_raw cryptd sp5100_tco pcspkr xhci_pci vxlan ip6_udp_tunnel fam15h_power sky2 udp_tunnel xhci_hcd soundcore dm_mod k10temp i2c_piix4 shpchp wmi acpi_cpufreq asus_atk0110 button processor ata_generic firewire_ohci firewire_core ohci_pci crc_itu_t radeon i2c_algo_bit drm_kms_helper pata_jmicron syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm sg [last unloaded: kvm]
[ 192.399986] CPU: 4 PID: 2037 Comm: qemu-system-x86 Not tainted 4.3.0-rc4+ #4
[ 192.408260] Hardware name: System manufacturer System Product Name/Crosshair IV Formula, BIOS 3027 10/28/2011
[ 192.419746] task: ffff880223e24040 ti: ffff8800cae5c000 task.ti: ffff8800cae5c000
[ 192.428506] RIP: 0010:[<ffff880224582608>] [<ffff880224582608>] 0xffff880224582608
[ 192.437376] RSP: 0018:ffff8800cae5fe58 EFLAGS: 00010286
[ 192.443940] RAX: ffff8800cb3c8800 RBX: ffff8800cba55800 RCX: 0000000000000004
[ 192.452370] RDX: 0000000000000004 RSI: ffff8802233e7887 RDI: 0000000000000001
[ 192.460796] RBP: ffff8800cae5fe98 R08: 0000000000000ff8 R09: 0000000000000008
[ 192.469145] R10: 000000000001d300 R11: 0000000000000000 R12: ffff8800cba55800
[ 192.477584] R13: ffff8802233e7880 R14: ffff8800cba55830 R15: 00007fff43b30b50
[ 192.486025] FS: 00007f94375b2c00(0000) GS:ffff88022ed00000(0000) knlGS:0000000000000000
[ 192.495445] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 192.502481] CR2: ffff880224582608 CR3: 00000000cb9d9000 CR4: 00000000000406e0
[ 192.510850] Stack:
[ 192.514094] ffffffffa03f9733 0000000100000000 0000000000000001 ffff880223c74600
[ 192.522876] ffff8800ca4f6d88 00007fff43b30b50 0000000000003b6a 00007fff43b30b50
[ 192.531582] ffff8800cae5ff08 ffffffff811efc7d ffff8800cae5fec8 ffff880223c74600
[ 192.540439] Call Trace:
[ 192.544145] [<ffffffffa03f9733>] ? vfio_group_fops_unl_ioctl+0x253/0x410 [vfio]
[ 192.552898] [<ffffffff811efc7d>] do_vfs_ioctl+0x2cd/0x4c0
[ 192.559713] [<ffffffff811f9687>] ? __fget+0x77/0xb0
[ 192.565998] [<ffffffff811efee9>] SyS_ioctl+0x79/0x90
[ 192.572373] [<ffffffff81001bb0>] ? syscall_return_slowpath+0x50/0x130
[ 192.580258] [<ffffffff8167f776>] entry_SYSCALL_64_fastpath+0x16/0x75
[ 192.588049] Code: 88 ff ff d8 25 58 24 02 88 ff ff e8 25 58 24 02 88 ff ff e8 25 58 24 02 88 ff ff 58 a2 70 21 02 88 ff ff c0 65 39 cb 00 88 ff ff <08> 2d 58 24 02 88 ff ff 08 88 3c cb 00 88 ff ff d8 58 c1 24 02
[ 192.610309] RIP [<ffff880224582608>] 0xffff880224582608
[ 192.616940] RSP <ffff8800cae5fe58>
[ 192.621805] CR2: ffff880224582608
[ 192.632826] ---[ end trace ce135ef0c9b1869f ]---
I am not sure whether this is an IOMMU or VFIO bug, have you seen
something like this before?
Joerg
next reply other threads:[~2015-10-09 14:58 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-09 14:58 Joerg Roedel [this message]
2015-10-09 15:30 ` Alex Williamson
2015-10-09 15:34 ` Joerg Roedel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20151009145827.GB27420@8bytes.org \
--to=joro@8bytes.org \
--cc=alex.williamson@redhat.com \
--cc=iommu@lists.linux-foundation.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome