| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+bH9dW4cUGR6csGNT0wBRKhF30_Gogz726CqO_6hn3Y=A@mail.gmail.com>
Date: Thu, 23 Mar 2017 17:42:30 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: Paolo Bonzini <pbonzini@...hat.com>
Cc: Radim Krčmář <rkrcmar@...hat.com>,
Steve Rutherford <srutherford@...gle.com>,
syzkaller <syzkaller@...glegroups.com>,
KVM list <kvm@...r.kernel.org>,
Xiao Guangrong <guangrong.xiao@...ux.intel.com>,
Haozhong Zhang <haozhong.zhang@...el.com>,
James Mattson <jmattson@...gle.com>,
Wanpeng Li <kernellwp@...il.com>, P J P <ppandit@...hat.com>,
LKML <linux-kernel@...r.kernel.org>,
David Hildenbrand <david@...hat.com>
Subject: Re: kvm: BUG in pte_list_remove
On Mon, Nov 14, 2016 at 10:43 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> On Mon, Nov 14, 2016 at 10:34 AM, Paolo Bonzini <pbonzini@...hat.com> wrote:
>>
>>
>> On 14/11/2016 10:03, Dmitry Vyukov wrote:
>>> Paolo,
>>> can you please also commit this test to tools/testing? We are
>>> frustrated by the situation that we reported hundreds of bugs with
>>> reproducers, but exactly 0 kernel regression tests were added.
>>
>> Ok. Last time I only put the reproducers in commit messages. We can
>> look into adding some KVM regression testing to tools/testing this time.
>
>
> Tests in commit messages will be lost.
> Growing a base of kernel regression tests will be great.
>
>
>>> On Sun, Nov 13, 2016 at 5:00 PM, Paolo Bonzini <pbonzini@...hat.com> wrote:
>>>> Beautified source code:
>>>>
>>>> #include <fcntl.h>
>>>> #include <pthread.h>
>>>> #include <setjmp.h>
>>>> #include <signal.h>
>>>> #include <stddef.h>
>>>> #include <stdint.h>
>>>> #include <stdio.h>
>>>> #include <stdlib.h>
>>>> #include <string.h>
>>>> #include <sys/ioctl.h>
>>>> #include <sys/stat.h>
>>>> #include <sys/syscall.h>
>>>> #include <sys/types.h>
>>>> #include <unistd.h>
>>>> #include <linux/kvm.h>
>>>>
>>>> long r[16];
>>>>
>>>> int main()
>>>> {
>>>> void *p = valloc(0x4000);
>>>>
>>>> r[2] = open("/dev/kvm", 0);
>>>> r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
>>>>
>>>> uint64_t addr = 0xf000;
>>>> ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
>>>> r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
>>>> ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
>>>> ioctl(r[6], KVM_RUN, 0);
>>>> ioctl(r[6], KVM_RUN, 0);
>>>>
>>>> struct kvm_userspace_memory_region mr = {
>>>> .slot = 0,
>>>> .flags = KVM_MEM_LOG_DIRTY_PAGES,
>>>> .guest_phys_addr = 0xf000,
>>>> .memory_size = 0x4000,
>>>> .userspace_addr = (uintptr_t) p
>>>> };
>>>> ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
>>>> return 0;
>>>> }
This is still happens on a recent 093b995e3b55a0ae0670226ddfcb05bfbf0099ae:
------------[ cut here ]------------
kernel BUG at arch/x86/kvm/mmu.c:1157!
invalid opcode: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 2966 Comm: a.out Not tainted 4.11.0-rc3+ #365
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006432a5c0 task.stack: ffff880064e48000
RIP: 0010:pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156
RSP: 0018:ffff880064e4eda0 EFLAGS: 00010282
RAX: 0000000000000028 RBX: ffff88006ac72180 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 1ffff1000c9c9d72 RDI: ffffed000c9c9da8
RBP: ffff880064e4ede0 R08: ffffed000da03dae R09: ffffed000da03dae
R10: 0000000000000001 R11: ffffed000da03dad R12: 000000000000000f
R13: 0000000000000000 R14: ffff88006bcd8ec0 R15: ffff88006bcd8ee8
FS: 0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000006870b000 CR4: 00000000001426f0
Call Trace:
rmap_remove arch/x86/kvm/mmu.c:1233 [inline]
drop_spte+0x16c/0x270 arch/x86/kvm/mmu.c:1315
mmu_page_zap_pte+0x223/0x350 arch/x86/kvm/mmu.c:2427
kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2449 [inline]
kvm_mmu_prepare_zap_page+0x1bb/0x1260 arch/x86/kvm/mmu.c:2493
kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:5123 [inline]
kvm_mmu_invalidate_zap_all_pages+0x4a8/0x680 arch/x86/kvm/mmu.c:5164
kvm_arch_flush_shadow_all+0x15/0x20 arch/x86/kvm/x86.c:8370
kvm_mmu_notifier_release+0x71/0xb0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:472
__mmu_notifier_release+0x1e5/0x6b0 mm/mmu_notifier.c:75
mmu_notifier_release include/linux/mmu_notifier.h:235 [inline]
exit_mmap+0x3a3/0x470 mm/mmap.c:2941
__mmput kernel/fork.c:894 [inline]
mmput+0x25e/0x790 kernel/fork.c:916
exit_mm kernel/exit.c:558 [inline]
do_exit+0xa51/0x26d0 kernel/exit.c:866
do_group_exit+0x149/0x400 kernel/exit.c:983
SYSC_exit_group kernel/exit.c:994 [inline]
SyS_exit_group+0x1d/0x20 kernel/exit.c:992
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x433609
RSP: 002b:00007ffdbe967178 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000433609
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7
R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000d7fbb0
R13: 000000000001b411 R14: 0000000000002710 R15: 00000000006c08b8
Code: 99 f9 5d 00 48 8b 75 d0 48 c7 c7 00 4a 42 84 e8 9c 13 72 00 0f
0b e8 82 f9 5d 00 48 8b 75 d0 48 c7 c7 c0 49 42 84 e8 85 13 72 00 <0f>
0b 4c 89 ef e8 78 14 8c 00 e9 01 fe ff ff 0f 1f 00 55 48 89
RIP: pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156 RSP: ffff880064e4eda0
---[ end trace 2cf22c8ade550ee0 ]---
#include <fcntl.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/kvm.h>
long r[16];
int main()
{
void *p = valloc(0x4000);
r[2] = open("/dev/kvm", 0);
r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
uint64_t addr = 0xf000;
ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
ioctl(r[6], KVM_RUN, 0);
ioctl(r[6], KVM_RUN, 0);
struct kvm_userspace_memory_region mr = {
.slot = 0,
.flags = KVM_MEM_LOG_DIRTY_PAGES,
.guest_phys_addr = 0xf000,
.memory_size = 0x4000,
.userspace_addr = (uintptr_t) p
};
ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
return 0;
}
Powered by blists - more mailing lists