[syzbot] [kvm?] WARNING in kvm_vcpu_pre_fault_memory

[syzbot] [kvm?] WARNING in kvm_vcpu_pre_fault_memory

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    ce1e0223d8ad Merge tag 'devicetree-fixes-for-7.3-2' of git..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=1353dbf5580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=9d4242cb1c54cdf7
dashboard link: https://syzkaller.appspot.com/bug?extid=db7bd0f41c2a7e82d4ba
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14cdf6c9580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12cdf6c9580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/217b0c1b14ee/disk-ce1e0223.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/335343cc5803/vmlinux-ce1e0223.xz
kernel image: https://storage.googleapis.com/syzbot-assets/760ef2f39df0/bzImage-ce1e0223.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+db7bd0f41c2a7e82d4ba@syzkaller.appspotmail.com

------------[ cut here ]------------
r == 0 || r == -EIO
WARNING: arch/x86/kvm/../../../virt/kvm/kvm_main.c:4389 at kvm_vcpu_pre_fault_memory+0x45d/0x470 virt/kvm/kvm_main.c:4389, CPU#1: syz-executor267/8523
Modules linked in:
CPU: 1 UID: 0 PID: 8523 Comm: syz-executor267 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:kvm_vcpu_pre_fault_memory+0x45d/0x470 virt/kvm/kvm_main.c:4389
Code: fe ff ff e8 85 2e 88 00 90 0f 0b 90 e9 0d ff ff ff e8 77 2e 88 00 e8 42 85 f3 ff eb 8f e8 6b 2e 88 00 eb 05 e8 64 2e 88 00 90 <0f> 0b 90 e9 a7 fe ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90
RSP: 0018:ffffc900024dfc28 EFLAGS: 00010293
RAX: ffffffff813fe025 RBX: ffffc900024dfe00 RCX: ffff88807fcc0000
RDX: 0000000000000000 RSI: ffffffff8eaf6510 RDI: fffffffffffffffb
RBP: dffffc0000000000 R08: ffff88807fcc0000 R09: 0000000000000002
R10: fffffffffffffffb R11: 0000000000000000 R12: ffffc900024dfe00
R13: ffff88807fcc0000 R14: 1ffff1100ff98000 R15: fffffffffffffffb
FS:  00007f9c411186c0(0000) GS:ffff888124dc7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9c4116312d CR3: 0000000026a4a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 kvm_vcpu_ioctl+0x8a6/0xfd0 virt/kvm/kvm_main.c:4668
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9c4118db49
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9c411181d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f9c4123bb88 RCX: 00007f9c4118db49
RDX: 0000200000000100 RSI: 00000000c040aed5 RDI: 0000000000000005
RBP: 00007f9c4123bb80 R08: 38203a6b63617473 R09: 38203a6b63617473
R10: 38203a6b63617473 R11: 0000000000000246 R12: 00007f9c4120b858
R13: 0000200000000118 R14: 0000200000000100 R15: 0000200000000600
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [kvm?] WARNING in kvm_vcpu_pre_fault_memory

[Sean Christopherson]

On Sun, Oct 04, 2026, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    ce1e0223d8ad Merge tag 'devicetree-fixes-for-7.3-2' of git..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1353dbf5580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=9d4242cb1c54cdf7
> dashboard link: https://syzkaller.appspot.com/bug?extid=db7bd0f41c2a7e82d4ba
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14cdf6c9580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12cdf6c9580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/217b0c1b14ee/disk-ce1e0223.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/335343cc5803/vmlinux-ce1e0223.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/760ef2f39df0/bzImage-ce1e0223.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+db7bd0f41c2a7e82d4ba@syzkaller.appspotmail.com
> 
> ------------[ cut here ]------------
> r == 0 || r == -EIO
> WARNING: arch/x86/kvm/../../../virt/kvm/kvm_main.c:4389 at kvm_vcpu_pre_fault_memory+0x45d/0x470 virt/kvm/kvm_main.c:4389, CPU#1: syz-executor267/8523
> Modules linked in:
> CPU: 1 UID: 0 PID: 8523 Comm: syz-executor267 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
> RIP: 0010:kvm_vcpu_pre_fault_memory+0x45d/0x470 virt/kvm/kvm_main.c:4389
> Code: fe ff ff e8 85 2e 88 00 90 0f 0b 90 e9 0d ff ff ff e8 77 2e 88 00 e8 42 85 f3 ff eb 8f e8 6b 2e 88 00 eb 05 e8 64 2e 88 00 90 <0f> 0b 90 e9 a7 fe ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90
> RSP: 0018:ffffc900024dfc28 EFLAGS: 00010293
> RAX: ffffffff813fe025 RBX: ffffc900024dfe00 RCX: ffff88807fcc0000
> RDX: 0000000000000000 RSI: ffffffff8eaf6510 RDI: fffffffffffffffb
> RBP: dffffc0000000000 R08: ffff88807fcc0000 R09: 0000000000000002
> R10: fffffffffffffffb R11: 0000000000000000 R12: ffffc900024dfe00
> R13: ffff88807fcc0000 R14: 1ffff1100ff98000 R15: fffffffffffffffb
> FS:  00007f9c411186c0(0000) GS:ffff888124dc7000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f9c4116312d CR3: 0000000026a4a000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  kvm_vcpu_ioctl+0x8a6/0xfd0 virt/kvm/kvm_main.c:4668
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:597 [inline]
>  __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f

I haven't tried the reproducer yet, but based on code inspection I'm pretty sure
the kvm_vm_dead() call in enter_smm() is colliding with commit 958810a09412d
("KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead"), especialy since there
is SMM setup in the reproducer.

I'm think we can and should just drop EIO from the WARN.  It showed up in v5 of
the original series without any real explanation.  v5 did add -EIO as a documented
error code[1]:
  
  v4->v5:
    - add EIO as possible error

in response to Xiaoyao's review[2]:

  > +	case RET_PF_CONTINUE:
  > +	case RET_PF_INVALID:
  > +	default:
  > +		WARN_ON_ONCE(r);
  > +		return -EIO;
  
  Need to update patch 1 for -EIO
  
  > +	}


but AFAICT that was just talking about the documentation.  And at the time, KVM
x86 already WARNed when returning -EIO, so I've no idea common KVM also WARNed
on seeing -EIO.

[1] https://lore.kernel.org/all/20240710174031.312055-1-pbonzini@redhat.com
[2] https://lore.kernel.org/all/d5a6e125-bff4-4d82-ae65-b99d9cb10e90@intel.com