linux-kernel - kvm: GPF in kvm_pic_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+YuZdCjtYtEz+QMubOeGES97KLEehKf+LsyBtAb09eHqw@mail.gmail.com>
Date:   Fri, 11 Nov 2016 18:51:58 -0800
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Paolo Bonzini <pbonzini@...hat.com>, rkrcmar@...hat.com,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "x86@...nel.org" <x86@...nel.org>, KVM list <kvm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Steve Rutherford <srutherford@...gle.com>
Cc:     syzkaller <syzkaller@...glegroups.com>
Subject: kvm: GPF in kvm_pic_set_irq

Hello,

The following program triggers GPF in kvm_pic_set_irq in run in a parallel loop:
https://gist.githubusercontent.com/dvyukov/0d868a3fcec50758ccf638dc87827ab3/raw/526bb6285785137e5d7c89dad2bdd05c66337daf/gistfile1.txt

On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).

general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3308 Comm: kvm-pit/3270 Not tainted 4.9.0-rc4+ #42
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88003b85adc0 task.stack: ffff8800387e8000
RIP: 0010:[<ffffffff8133aaf5>]  [<ffffffff8133aaf5>]
__lock_acquire+0x125/0x3630 kernel/locking/lockdep.c:3221
RSP: 0018:ffff8800387ef8b0  EFLAGS: 00010006
RAX: dffffc0000000000 RBX: ffff88003b85adc0 RCX: 0000000000000000
RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000018
RBP: ffff8800387efa48 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff84da1600 R11: 1ffff100070fdf2c R12: ffff88003b85adc0
R13: ffffffff83c19020 R14: 0000000000000001 R15: 0000000000000018
FS:  0000000000000000(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e0000 CR3: 000000006c006000 CR4: 00000000000026f0
Stack:
 0000000000000000 ffff8800387ef8c8 0000000000000046 ffff8800387ef980
 0000000000000046 ffff88003b85adc0 ffff88003b85adc0 ffff88003b85b5c0
 ffff88003b85adc0 ffffffff83c19020 ffff88003b85b5e2 0000000000000000
Call Trace:
 [<ffffffff8133eb19>] lock_acquire+0x169/0x330 kernel/locking/lockdep.c:3746
 [<     inline     >] __raw_spin_lock include/linux/spinlock_api_smp.h:144
 [<ffffffff831eb283>] _raw_spin_lock+0x33/0x50 kernel/locking/spinlock.c:151
 [<     inline     >] pic_lock include/linux/spinlock.h:302
 [<ffffffff811159ea>] kvm_pic_set_irq+0x3a/0x720 arch/x86/kvm/i8259.c:197
 [<ffffffff8112de0c>] kvm_set_pic_irq+0x7c/0xa0 arch/x86/kvm/irq_comm.c:44
 [<ffffffff8106fee9>] kvm_set_irq+0x1c9/0x460
arch/x86/kvm/../../../virt/kvm/irqchip.c:101
 [<ffffffff8112766b>] pit_do_work+0xdb/0x2d0 arch/x86/kvm/i8254.c:250
 [<ffffffff812a7f9e>] kthread_worker_fn+0x37e/0x780 kernel/kthread.c:624
 [<ffffffff812a7a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
 [<ffffffff831ebf6a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
Code: 0f 1f 44 00 00 f6 c4 02 0f 85 5d 0a 00 00 44 8b 35 41 b6 7a 02
45 85 f6 74 2c 4c 89 fa 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
3c 02 00 0f 85 6e 30 00 00 49 81 3f 60 d0 10 84 41 be 00 00
RIP  [<ffffffff8133aaf5>] __lock_acquire+0x125/0x3630
kernel/locking/lockdep.c:3221
 RSP <ffff8800387ef8b0>
---[ end trace b74c04baf1b86ffa ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1