linux-kernel - kvm: GPF in irq_bypass_unregister

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Nov 2016 17:21:26 -0800
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Alex Williamson <alex.williamson@...hat.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        KVM list <kvm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Steve Rutherford <srutherford@...gle.com>
Cc:     syzkaller <syzkaller@...glegroups.com>
Subject: kvm: GPF in irq_bypass_unregister_consumer

Hello,

The following programs triggers GPF in irq_bypass_unregister_consumer
if run in a parallel loop:
https://gist.githubusercontent.com/dvyukov/0d18d7b11659187ec3eab22285b4a67e/raw/c1c622ca26ebce0c7b77e3200970ca0f7792cb32/gistfile1.txt

On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).

general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 599 Comm: kworker/2:1 Not tainted 4.9.0-rc4+ #41
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: kvm-irqfd-cleanup irqfd_shutdown
task: ffff88006cb51700 task.stack: ffff88006cbd8000
RIP: 0010:[<ffffffff831d3957>]  [<     inline     >] __list_del
include/linux/list.h:89
RIP: 0010:[<ffffffff831d3957>]  [<     inline     >] list_del
include/linux/list.h:107
RIP: 0010:[<ffffffff831d3957>]  [<ffffffff831d3957>]
irq_bypass_unregister_consumer+0x237/0x360 virt/lib/irqbypass.c:258
RSP: 0018:ffff88006cbdfb68  EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88006cb51f00
RDX: 0000000000000001 RSI: ffff88006cb51f50 RDI: 0000000000000008
RBP: ffff88006cbdfb90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003caea638
R13: 0000000000000000 R14: ffffffff83ece9a0 R15: ffff88006bb0a530
FS:  0000000000000000(0000) GS:ffff88006e200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e0000 CR3: 0000000003a1d000 CR4: 00000000000026e0
Stack:
 ffff88003caea4d0 ffff88003caea5f8 1ffff1000d97bf75 ffff88003caea5d0
 dffffc0000000000 ffff88006cbdfc30 ffffffff8106d144 0000000000000000
 0000000041b58ab3 ffffffff837c38d1 ffffffff8106d030 0000000000000246
Call Trace:
 [<ffffffff8106d144>] irqfd_shutdown+0x114/0x1a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:145
 [<ffffffff8129375c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096
 [<ffffffff8129474f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230
 [<ffffffff812a7a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
 [<ffffffff831ebf6a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b7 00 00 00 49 8d 7d 08
48 b8 00 00 00 00 00 fc ff df 49 8b 5c 24 08 48 89 fa 48 c1 ea 03 <80>
3c 02 00 0f 85 9d 00 00 00 48 89 da 48 b8 00 00 00 00 00 fc
RIP  [<     inline     >] __list_del include/linux/list.h:89
RIP  [<     inline     >] list_del include/linux/list.h:107
RIP  [<ffffffff831d3957>] irq_bypass_unregister_consumer+0x237/0x360
virt/lib/irqbypass.c:258
 RSP <ffff88006cbdfb68>
---[ end trace 986ec3b53e4e0338 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1