linux-kernel - Re: freeze host when injecting NMIs in the guest, at least in 4.4-rc4+

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151210164407.GA3593@nazgul.tnic>
Date:	Thu, 10 Dec 2015 17:44:07 +0100
From:	Borislav Petkov <bp@...en8.de>
To:	kvm@...r.kernel.org
Cc:	Paolo Bonzini <pbonzini@...hat.com>,
	lkml <linux-kernel@...r.kernel.org>, qemu-devel@...gnu.org
Subject: Re: freeze host when injecting NMIs in the guest, at least in
 4.4-rc4+

Yap,

this is clearly a qemu/kvm issue. Lemme remove ext4 folks from CC. So
here's what happens:

I boot a kvm guest, connect to its monitor (qemu is started with
"-monitor pty") and on the monitor I issue a couple of times the "nmi"
command. It doesn't explode immediately but it happens pretty often and
when it happens, the *host*(!) freezes with some nasty corruption, see
below.

Thoughts, suggestions, ideas?

...
[   13.564192] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[  111.524485] kvm: zapping shadow pages for mmio generation wraparound
[  166.414836] EXT4-fs (sdb1): mounted filesystem with ordered data mode. Opts: (null)
[  172.408126] kvm: zapping shadow pages for mmio generation wraparound
[  200.912827] BUG: unable to handle kernel NULL pointer dereference at           (null)
[  200.920716] IP: [<          (null)>]           (null)
[  200.925796] PGD 0 
[  200.927833] Oops: 0010 [#1] PREEMPT SMP 
[  200.931258] Modules linked in: binfmt_misc ipv6 vfat fat fuse dm_crypt dm_mod kvm_amd kvm irqq
[  200.931274] CPU: 0 PID: 3936 Comm: qemu-system-x86 Not tainted 4.4.0-rc4+ #1
[  200.931275] Hardware name: To be filled by O.E.M. To be filled by O.E.M./M5A97 EVO R2.0, BIOS3
[  200.931276] task: ffff880037ba0000 ti: ffff8804227d8000 task.ti: ffff8804227d8000
[  200.931277] RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)
[  200.931278] RSP: 0018:ffff8804227dbcb0  EFLAGS: 00010292
[  200.931278] RAX: ffff880037ba0000 RBX: 0000000000000292 RCX: 0000000000000003
[  200.931279] RDX: ffff880037ba0750 RSI: 0000000000000000 RDI: ffff880037ba0001
[  200.931280] RBP: ffff8804227dbd08 R08: 0000000000000001 R09: 00000011f89b6000
[  200.931280] R10: ffffffff825c4fd0 R11: 0000000000000000 R12: 0000000000000000
[  200.931281] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[  200.931282] FS:  00007fec0faba700(0000) GS:ffff88042c600000(0000) knlGS:0000000000000000
[  200.931283] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  200.931283] CR2: 0000000000000000 CR3: 00000000b6566000 CR4: 00000000000406f0
[  200.931283] Stack:
[  200.931285]  ffffffff8121004e ffff880400000000 ffffffff00000000 0000000000000292
[  200.931287]  00000000a0305d3c ffff880414612280 ffff880414612210 ffff8804227dbe90
[  200.931288]  ffff880414612130 ffff880037ba0000 ffffffff8121004e ffff8804227dbd90
[  200.931288] Call Trace:
[  200.931293]  [<ffffffff8121004e>] ? ext4_file_write_iter+0x8e/0x470
[  200.931295]  [<ffffffff8121004e>] ? ext4_file_write_iter+0x8e/0x470
[  200.931298]  [<ffffffff816de106>] mutex_lock_nested+0x66/0x3d0
[  200.931299]  [<ffffffff8121004e>] ? ext4_file_write_iter+0x8e/0x470
[  200.931301]  [<ffffffff8121004e>] ? ext4_file_write_iter+0x8e/0x470
[  200.931303]  [<ffffffff810a916a>] ? __lock_acquire+0x55a/0x1f80
[  200.931305]  [<ffffffff8121004e>] ext4_file_write_iter+0x8e/0x470
[  200.931307]  [<ffffffff811ac78e>] ? __fget+0x11e/0x210
[  200.931309]  [<ffffffff810a2cb4>] ? percpu_down_read+0x44/0x90
[  200.931311]  [<ffffffff8118d47d>] __vfs_write+0xad/0xe0
[  200.931313]  [<ffffffff8118dcd5>] vfs_write+0xb5/0x1a0
[  200.931315]  [<ffffffff8118e912>] SyS_write+0x52/0xc0
[  200.931317]  [<ffffffff816e2d5b>] entry_SYSCALL_64_fastpath+0x16/0x6f
[  200.931319] Code:  Bad RIP value.
[  200.931320] RIP  [<          (null)>]           (null)
[  200.931321]  RSP <ffff8804227dbcb0>
[  200.931321] CR2: 0000000000000000
[  200.939353] ---[ end trace 70675f54590d7755 ]---
[  200.939370] note: qemu-system-x86[3936] exited with preempt_count 1


-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/