| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <15D0C887-E17F-4432-8716-BF62EEE61B6B@sjtu.edu.cn>
Date: Mon, 14 Jul 2025 22:56:44 +0800
From: Zheyun Shen <szy0127@...u.edu.cn>
To: Sean Christopherson <seanjc@...gle.com>
Cc: Srikanth Aithal <sraithal@....com>,
linux-next@...r.kernel.org,
kvm@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [BUG] NULL pointer dereference in sev_writeback_caches during KVM
SEV migration kselftest on AMD platform
The problem is triggered by the following codes in tools/testing/selftests/kvm/x86/sev_migrate_tests.c:
static void test_sev_migrate_from(bool es)
{
struct kvm_vm *src_vm;
struct kvm_vm *dst_vms[NR_MIGRATE_TEST_VMS];
int i, ret;
src_vm = sev_vm_create(es);
for (i = 0; i < NR_MIGRATE_TEST_VMS; ++i)
dst_vms[i] = aux_vm_create(true);
/* Initial migration from the src to the first dst. */
sev_migrate_from(dst_vms[0], src_vm);
for (i = 1; i < NR_MIGRATE_TEST_VMS; i++)
sev_migrate_from(dst_vms[i], dst_vms[i - 1]);
/* Migrate the guest back to the original VM. */
ret = __sev_migrate_from(src_vm, dst_vms[NR_MIGRATE_TEST_VMS - 1]);
TEST_ASSERT(ret == -1 && errno == EIO,
"VM that was migrated from should be dead. ret %d, errno: %d", ret,
errno);
kvm_vm_free(src_vm);
for (i = 0; i < NR_MIGRATE_TEST_VMS; ++i)
kvm_vm_free(dst_vms[i]);
}
I add some logs in kvm and following shows the result:
[ 51.618135] sev guest init kvm:ff177f272432e000
[ 51.627235] kvm destory vm kvm:ff177f272432e000
[ 51.628011] kvm destory vm mmu notifier unregister kvm:ff177f272432e000
[ 51.642840] kvm destory vm arch destory vm kvm:ff177f272432e000
[ 51.673612] vm destory x86
[ 51.673957] svm vm destory
[ 51.674401] kvm destory vm kvm:ff177f272432c000
[ 51.675152] kvm destory vm mmu notifier unregister kvm:ff177f272432c000
[ 51.675981] kvm destory vm arch destory vm kvm:ff177f272432c000
[ 51.715937] vm destory x86
[ 51.716289] svm vm destory
[ 51.716754] kvm destory vm kvm:ff177f272432a000
[ 51.717530] kvm destory vm mmu notifier unregister kvm:ff177f272432a000
[ 51.718363] kvm destory vm arch destory vm kvm:ff177f272432a000
[ 51.746672] vm destory x86
[ 51.747018] svm vm destory
[ 51.747454] kvm destory vm kvm:ff177f2724328000
[ 51.748219] kvm destory vm mmu notifier unregister kvm:ff177f2724328000
[ 51.749033] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 51.749885] #PF: supervisor read access in kernel mode
[ 51.750519] #PF: error_code(0x0000) - not-present page
It seems that the cpumask structure is not transferred correctly from ff177f272432e000 to ff177f2724328000.
But unfortunately I’m not familiar with SEV migration. I need to spend some time looking into how SEV
migration works in order to solve this issue.
Thanks,
Zheyun Shen
> 2025年7月14日 22:48，Sean Christopherson <seanjc@...gle.com> 写道：
>
> On Mon, Jul 14, 2025, Zheyun Shen wrote:
>> Hi Aithal,
>> I can reproduce this issue in my environment, and I will try to resolve it as
>> soon as possible.
>
> Phew, that's good, because I can't repro this, and I don't see anything obviously
> wrong.
>
>>> 2025年7月14日 13:21，Aithal, Srikanth <sraithal@....com> 写道：
>>>
>>> Hello,
>>>
>>> While running the kselftest for SEV migration (sev_migrate_tes) on
>>> linux-next (6.16.0-rc5-next-20250711, commit a62b7a37e6) on an AMD-based
>>> paltforms [Milan,Genoa,Turin], I encountered below kernel crash while
>>> running kvm kselftests:
>>>
>>> [ 714.008402] BUG: kernel NULL pointer dereference, address: 0000000000000000
>>> [ 714.015363] #PF: supervisor read access in kernel mode
>>> [ 714.020504] #PF: error_code(0x0000) - not-present page
>>> [ 714.025643] PGD 11364b067 P4D 11364b067 PUD 12e195067 PMD 0
>>> [ 714.031303] Oops: Oops: 0000 [#1] SMP NOPTI
>>> [ 714.035487] CPU: 14 UID: 0 PID: 16663 Comm: sev_migrate_tes Not tainted 6.16.0-rc5-next-20250711-a62b7a37e6-42f78243e0c #1 PREEMPT(voluntary)
>>> [ 714.048253] Hardware name: Dell Inc. PowerEdge R6515/07PXPY, BIOS 2.17.0 12/04/2024
>>> [ 714.055905] RIP: 0010:_find_first_bit+0x1d/0x40
>
> ..
>
>>> [ 714.148307] ? sev_writeback_caches+0x25/0x40 [kvm_amd]
>>> [ 714.153544] sev_guest_memory_reclaimed+0x34/0x40 [kvm_amd]
>>> [ 714.159115] kvm_arch_guest_memory_reclaimed+0x12/0x20 [kvm]
>>> [ 714.164817] kvm_mmu_notifier_release+0x3c/0x60 [kvm]
>>> [ 714.169896] mmu_notifier_unregister+0x53/0xf0
>>> [ 714.174343] kvm_destroy_vm+0x12d/0x2d0 [kvm]
>>> [ 714.178727] kvm_vm_stats_release+0x34/0x60 [kvm]
>>> [ 714.183459] __fput+0xf2/0x2d0
>>> [ 714.186520] fput_close_sync+0x44/0xa0
>>> [ 714.190269] __x64_sys_close+0x42/0x80
>>> [ 714.194024] x64_sys_call+0x1960/0x2180
>>> [ 714.197861] do_syscall_64+0x56/0x1e0
>>> [ 714.201530] entry_SYSCALL_64_after_hwframe+0x76/0x7e
Powered by blists - more mailing lists