* kvm: GPF in kvm_irq_map_gsi
@ 2016-02-15 13:30 Dmitry Vyukov
2016-05-31 9:56 ` Paolo Bonzini
0 siblings, 1 reply; 3+ messages in thread
From: Dmitry Vyukov @ 2016-02-15 13:30 UTC (permalink / raw)
To: Gleb Natapov, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86, kvm, LKML
Cc: Eric Northup, Andrew Honig, Steve Rutherford, Robert Swiecki,
Kostya Serebryany, Alexander Potapenko, syzkaller
Hello,
The following program triggers GPF in kvm_irq_map_gsi:
general protection fault: 0000 [#49] SMP DEBUG_PAGEALLOC KASAN
Modules linked in:
CPU: 0 PID: 5314 Comm: kvm-pit/4950 Tainted: G D 4.5.0-rc3+ #326
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88005b848000 ti: ffff880056b70000 task.ti: ffff880056b70000
RIP: 0010:[<ffffffff81029221>] [<ffffffff81029221>] kvm_irq_map_gsi+0x81/0x430
RSP: 0018:ffff880056b77b40 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000024 RSI: ffff880056b77bd0 RDI: 0000000000000120
RBP: ffff880056b77b70 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88005b848000 R11: ffff880055fd0390 R12: 0000000000000000
R13: ffff880055fd0000 R14: ffff880056b77bd0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f87947bbd90 CR3: 000000002a2ed000 CR4: 00000000000026f0
Stack:
ffff880055fd0390 ffff880055fd0240 ffff880055fd0390 ffff880056b77bd0
0000000000000000 0000000000000000 ffff880056b77cd8 ffffffff81029a7c
ffffffff810299fe ffff88005b848000 1ffff1000ad6ef76 0000000200000001
Call Trace:
[<ffffffff81029a7c>] kvm_set_irq+0x15c/0x440
arch/x86/kvm/../../../virt/kvm/irqchip.c:94
[<ffffffff810dbd39>] pit_do_work+0x109/0x350 arch/x86/kvm/i8254.c:297
[<ffffffff813b8309>] kthread_worker_fn+0x2d9/0x660 kernel/kthread.c:595
[<ffffffff813b7edf>] kthread+0x23f/0x2d0 drivers/block/aoe/aoecmd.c:1303
[<ffffffff866617af>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
Code: 80 3d 59 0f 7f 07 00 0f 84 d8 02 00 00 e8 a8 29 54 00 49 8d bc
24 20 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f>
b6 04 02 84 c0 74 08 3c 03 0f 8e 8e 03 00 00 41 39 9c 24 20
RIP [<ffffffff81029221>] kvm_irq_map_gsi+0x81/0x430
arch/x86/kvm/../../../virt/kvm/irqchip.c:43
RSP <ffff880056b77b40>
---[ end trace a9bcc650712efe6c ]---
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <pthread.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>
long r[74];
void* thr(void* arg)
{
switch ((long)arg) {
case 0:
r[0] = syscall(SYS_mmap, 0x20000000ul, 0xe000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
break;
case 1:
memcpy((void*)0x2000d000, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d\x00",
9);
r[2] = syscall(SYS_open, "/dev/kvm", 0x2000ul, 0, 0, 0);
break;
case 2:
r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
break;
case 3:
r[4] = syscall(SYS_ioctl, r[3], 0xae60ul, 0, 0, 0, 0);
break;
case 4:
*(uint32_t*)0x20009000 = (uint32_t)0x4;
*(uint32_t*)0x20009004 = (uint32_t)0x0;
*(uint32_t*)0x20009008 = (uint32_t)0x0;
*(uint32_t*)0x2000900c = (uint32_t)0x0;
*(uint32_t*)0x20009010 = (uint32_t)0x0;
*(uint32_t*)0x20009014 = (uint32_t)0x0;
*(uint32_t*)0x20009018 = (uint32_t)0x0;
*(uint32_t*)0x2000901c = (uint32_t)0x0;
*(uint32_t*)0x20009020 = (uint32_t)0x0;
*(uint32_t*)0x20009024 = (uint32_t)0x0;
*(uint32_t*)0x20009028 = (uint32_t)0x0;
*(uint32_t*)0x2000902c = (uint32_t)0x0;
*(uint32_t*)0x20009030 = (uint32_t)0x0;
*(uint32_t*)0x20009034 = (uint32_t)0x0;
*(uint32_t*)0x20009038 = (uint32_t)0x0;
*(uint32_t*)0x2000903c = (uint32_t)0x0;
r[21] =
syscall(SYS_ioctl, r[3], 0x4040ae77ul, 0x20009000ul, 0, 0, 0);
break;
case 5:
*(uint32_t*)0x2000a6b9 = (uint32_t)0x3e;
*(uint16_t*)0x2000a6bd = (uint16_t)0x8;
*(uint8_t*)0x2000a6bf = (uint8_t)0x8d4;
*(uint8_t*)0x2000a6c0 = (uint8_t)0xffffffffffff5fe9;
*(uint8_t*)0x2000a6c1 = (uint8_t)0x80000001;
*(uint8_t*)0x2000a6c2 = (uint8_t)0x0;
*(uint8_t*)0x2000a6c3 = (uint8_t)0xbe2;
*(uint8_t*)0x2000a6c4 = (uint8_t)0x9;
*(uint8_t*)0x2000a6c5 = (uint8_t)0x7ff;
*(uint8_t*)0x2000a6c6 = (uint8_t)0x1;
*(uint8_t*)0x2000a6c7 = (uint8_t)0x1f;
*(uint8_t*)0x2000a6c8 = (uint8_t)0x1d8;
*(uint16_t*)0x2000a6c9 = (uint16_t)0x8;
*(uint32_t*)0x2000a6cd = (uint32_t)0x736d;
*(uint16_t*)0x2000a6d1 = (uint16_t)0x3;
*(uint8_t*)0x2000a6d3 = (uint8_t)0xff;
*(uint8_t*)0x2000a6d4 = (uint8_t)0x3;
*(uint8_t*)0x2000a6d5 = (uint8_t)0xffffffffffff8000;
*(uint8_t*)0x2000a6d6 = (uint8_t)0xc20;
*(uint8_t*)0x2000a6d7 = (uint8_t)0x6;
*(uint8_t*)0x2000a6d8 = (uint8_t)0x2;
*(uint8_t*)0x2000a6d9 = (uint8_t)0x6;
*(uint8_t*)0x2000a6da = (uint8_t)0x8;
*(uint8_t*)0x2000a6db = (uint8_t)0x3;
*(uint8_t*)0x2000a6dc = (uint8_t)0x1;
*(uint16_t*)0x2000a6dd = (uint16_t)0xce;
*(uint32_t*)0x2000a6e1 = (uint32_t)0xab85;
*(uint16_t*)0x2000a6e5 = (uint16_t)0x0;
*(uint8_t*)0x2000a6e7 = (uint8_t)0xa0e3;
*(uint8_t*)0x2000a6e8 = (uint8_t)0x100000001;
*(uint8_t*)0x2000a6e9 = (uint8_t)0x3;
*(uint8_t*)0x2000a6ea = (uint8_t)0x1;
*(uint8_t*)0x2000a6eb = (uint8_t)0x2;
*(uint8_t*)0x2000a6ec = (uint8_t)0x1;
*(uint8_t*)0x2000a6ed = (uint8_t)0x7ff;
*(uint8_t*)0x2000a6ee = (uint8_t)0x2;
*(uint8_t*)0x2000a6ef = (uint8_t)0x8a;
*(uint8_t*)0x2000a6f0 = (uint8_t)0xca6;
*(uint16_t*)0x2000a6f1 = (uint16_t)0x1;
*(uint32_t*)0x2000a6f5 = (uint32_t)0x401;
*(uint32_t*)0x2000a6f9 = (uint32_t)0x0;
*(uint32_t*)0x2000a6fd = (uint32_t)0x0;
*(uint32_t*)0x2000a701 = (uint32_t)0x0;
*(uint32_t*)0x2000a705 = (uint32_t)0x0;
*(uint32_t*)0x2000a709 = (uint32_t)0x0;
*(uint32_t*)0x2000a70d = (uint32_t)0x0;
*(uint32_t*)0x2000a711 = (uint32_t)0x0;
*(uint32_t*)0x2000a715 = (uint32_t)0x0;
*(uint32_t*)0x2000a719 = (uint32_t)0x0;
r[71] =
syscall(SYS_ioctl, r[3], 0x4070aea0ul, 0x2000a6b9ul, 0, 0, 0);
break;
case 6:
r[72] = syscall(SYS_mmap, 0x2000e000ul, 0x1000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
break;
case 7:
r[73] = syscall(SYS_ioctl, r[2], 0x5424ul, 0x2000e630ul, 0, 0, 0);
break;
}
return 0;
}
int main()
{
long i;
pthread_t th[8];
srand(getpid());
memset(r, -1, sizeof(r));
for (i = 0; i < 8; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
usleep(rand()%10000);
}
for (i = 0; i < 8; i++)
pthread_join(th[i], 0);
for (i = 0; i < 8; i++) {
pthread_create(&th[i], 0, thr, (void*)i);
if (rand()%2)
usleep(rand()%10000);
}
for (i = 0; i < 8; i++)
pthread_join(th[i], 0);
return 0;
}
On commit 388f7b1d6e8ca06762e2454d28d6c3c55ad0fe95 (4.5-rc3)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: kvm: GPF in kvm_irq_map_gsi
2016-02-15 13:30 kvm: GPF in kvm_irq_map_gsi Dmitry Vyukov
@ 2016-05-31 9:56 ` Paolo Bonzini
2016-06-21 18:13 ` Dmitry Vyukov
0 siblings, 1 reply; 3+ messages in thread
From: Paolo Bonzini @ 2016-05-31 9:56 UTC (permalink / raw)
To: Dmitry Vyukov, Gleb Natapov, Thomas Gleixner, Ingo Molnar,
H. Peter Anvin, x86, kvm, LKML
Cc: Eric Northup, Andrew Honig, Steve Rutherford, Robert Swiecki,
Kostya Serebryany, Alexander Potapenko, syzkaller
On 15/02/2016 14:30, Dmitry Vyukov wrote:
> *(uint32_t*)0x2000a6b9 = (uint32_t)0x3e;
> *(uint16_t*)0x2000a6bd = (uint16_t)0x8;
> *(uint8_t*)0x2000a6bf = (uint8_t)0x8d4;
> *(uint8_t*)0x2000a6c0 = (uint8_t)0xffffffffffff5fe9;
> *(uint8_t*)0x2000a6c1 = (uint8_t)0x80000001;
> *(uint8_t*)0x2000a6c2 = (uint8_t)0x0;
> *(uint8_t*)0x2000a6c3 = (uint8_t)0xbe2;
> *(uint8_t*)0x2000a6c4 = (uint8_t)0x9;
> *(uint8_t*)0x2000a6c5 = (uint8_t)0x7ff;
> *(uint8_t*)0x2000a6c6 = (uint8_t)0x1;
> *(uint8_t*)0x2000a6c7 = (uint8_t)0x1f;
> *(uint8_t*)0x2000a6c8 = (uint8_t)0x1d8;
> *(uint16_t*)0x2000a6c9 = (uint16_t)0x8;
This field (.channels[0].count_load_time) should be uint64_t. I
understand that it's all random, but it makes it even harder to follow
what's going on...
Thanks,
Paolo
> *(uint32_t*)0x2000a6cd = (uint32_t)0x736d;
> *(uint16_t*)0x2000a6d1 = (uint16_t)0x3;
> *(uint8_t*)0x2000a6d3 = (uint8_t)0xff;
> *(uint8_t*)0x2000a6d4 = (uint8_t)0x3;
> *(uint8_t*)0x2000a6d5 = (uint8_t)0xffffffffffff8000;
> *(uint8_t*)0x2000a6d6 = (uint8_t)0xc20;
> *(uint8_t*)0x2000a6d7 = (uint8_t)0x6;
> *(uint8_t*)0x2000a6d8 = (uint8_t)0x2;
> *(uint8_t*)0x2000a6d9 = (uint8_t)0x6;
> *(uint8_t*)0x2000a6da = (uint8_t)0x8;
> *(uint8_t*)0x2000a6db = (uint8_t)0x3;
> *(uint8_t*)0x2000a6dc = (uint8_t)0x1;
> *(uint16_t*)0x2000a6dd = (uint16_t)0xce;
> *(uint32_t*)0x2000a6e1 = (uint32_t)0xab85;
> *(uint16_t*)0x2000a6e5 = (uint16_t)0x0;
> *(uint8_t*)0x2000a6e7 = (uint8_t)0xa0e3;
> *(uint8_t*)0x2000a6e8 = (uint8_t)0x100000001;
> *(uint8_t*)0x2000a6e9 = (uint8_t)0x3;
> *(uint8_t*)0x2000a6ea = (uint8_t)0x1;
> *(uint8_t*)0x2000a6eb = (uint8_t)0x2;
> *(uint8_t*)0x2000a6ec = (uint8_t)0x1;
> *(uint8_t*)0x2000a6ed = (uint8_t)0x7ff;
> *(uint8_t*)0x2000a6ee = (uint8_t)0x2;
> *(uint8_t*)0x2000a6ef = (uint8_t)0x8a;
> *(uint8_t*)0x2000a6f0 = (uint8_t)0xca6;
> *(uint16_t*)0x2000a6f1 = (uint16_t)0x1;
> *(uint32_t*)0x2000a6f5 = (uint32_t)0x401;
> *(uint32_t*)0x2000a6f9 = (uint32_t)0x0;
> *(uint32_t*)0x2000a6fd = (uint32_t)0x0;
> *(uint32_t*)0x2000a701 = (uint32_t)0x0;
> *(uint32_t*)0x2000a705 = (uint32_t)0x0;
> *(uint32_t*)0x2000a709 = (uint32_t)0x0;
> *(uint32_t*)0x2000a70d = (uint32_t)0x0;
> *(uint32_t*)0x2000a711 = (uint32_t)0x0;
> *(uint32_t*)0x2000a715 = (uint32_t)0x0;
> *(uint32_t*)0x2000a719 = (uint32_t)0x0;
> r[71] =
> syscall(SYS_ioctl, r[3], 0x4070aea0ul, 0x2000a6b9ul, 0, 0, 0);
> break;
> case 6:
> r[72] = syscall(SYS_mmap, 0x2000e000ul, 0x1000ul, 0x3ul, 0x32ul,
> 0xfffffffffffffffful, 0x0ul);
> break;
> case 7:
> r[73] = syscall(SYS_ioctl, r[2], 0x5424ul, 0x2000e630ul, 0, 0, 0);
> break;
> }
> return 0;
> }
>
> int main()
> {
> long i;
> pthread_t th[8];
>
> srand(getpid());
> memset(r, -1, sizeof(r));
> for (i = 0; i < 8; i++) {
> pthread_create(&th[i], 0, thr, (void*)i);
> usleep(rand()%10000);
> }
> for (i = 0; i < 8; i++)
> pthread_join(th[i], 0);
> for (i = 0; i < 8; i++) {
> pthread_create(&th[i], 0, thr, (void*)i);
> if (rand()%2)
> usleep(rand()%10000);
> }
> for (i = 0; i < 8; i++)
> pthread_join(th[i], 0);
> return 0;
> }
>
>
> On commit 388f7b1d6e8ca06762e2454d28d6c3c55ad0fe95 (4.5-rc3)
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: kvm: GPF in kvm_irq_map_gsi
2016-05-31 9:56 ` Paolo Bonzini
@ 2016-06-21 18:13 ` Dmitry Vyukov
0 siblings, 0 replies; 3+ messages in thread
From: Dmitry Vyukov @ 2016-06-21 18:13 UTC (permalink / raw)
To: Paolo Bonzini
Cc: Gleb Natapov, Thomas Gleixner, Ingo Molnar, H. Peter Anvin, x86,
KVM list, LKML, Eric Northup, Andrew Honig, Steve Rutherford,
Robert Swiecki, Kostya Serebryany, Alexander Potapenko,
syzkaller
On Tue, May 31, 2016 at 11:56 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
>
> On 15/02/2016 14:30, Dmitry Vyukov wrote:
>> *(uint32_t*)0x2000a6b9 = (uint32_t)0x3e;
>> *(uint16_t*)0x2000a6bd = (uint16_t)0x8;
>> *(uint8_t*)0x2000a6bf = (uint8_t)0x8d4;
>> *(uint8_t*)0x2000a6c0 = (uint8_t)0xffffffffffff5fe9;
>> *(uint8_t*)0x2000a6c1 = (uint8_t)0x80000001;
>> *(uint8_t*)0x2000a6c2 = (uint8_t)0x0;
>> *(uint8_t*)0x2000a6c3 = (uint8_t)0xbe2;
>> *(uint8_t*)0x2000a6c4 = (uint8_t)0x9;
>> *(uint8_t*)0x2000a6c5 = (uint8_t)0x7ff;
>> *(uint8_t*)0x2000a6c6 = (uint8_t)0x1;
>> *(uint8_t*)0x2000a6c7 = (uint8_t)0x1f;
>> *(uint8_t*)0x2000a6c8 = (uint8_t)0x1d8;
>> *(uint16_t*)0x2000a6c9 = (uint16_t)0x8;
>
> This field (.channels[0].count_load_time) should be uint64_t. I
> understand that it's all random, but it makes it even harder to follow
> what's going on...
Thanks! Fixed in:
https://github.com/google/syzkaller/commit/1816c21f2bed9b6015f1af1c5423779d2c6e58ad
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-06-21 18:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-15 13:30 kvm: GPF in kvm_irq_map_gsi Dmitry Vyukov
2016-05-31 9:56 ` Paolo Bonzini
2016-06-21 18:13 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®