linux-kernel - Re: [syzbot] [kvm?] WARNING in vcpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6959888c.050a0220.a1b6.0377.GAE@google.com>
Date: Sat, 03 Jan 2026 13:22:20 -0800
From: syzbot <syzbot+1522459a74d26b0ac33a@...kaller.appspotmail.com>
To: alessandro@...5c.net
Cc: alessandro@...5c.net, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [kvm?] WARNING in vcpu_run

> #syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

I've failed to parse your command.
Did you perhaps forget to provide the branch name, or added an extra ':'?
Please use one of the two supported formats:
1. #syz test
2. #syz test: repo branch-or-commit-hash
Note the lack of ':' in option 1.

> master
>
> From 2090baeb71f48c9ad62129bd457a2c3bb5f0ed55 Mon Sep 17 00:00:00 2001
> From: Alessandro Ratti <alessandro@...5c.net>
> Date: Sat, 3 Jan 2026 22:01:32 +0100
> Subject: [PATCH] KVM: x86: Handle -EBUSY from nested event check in
>  vcpu_block()
>
> When a vCPU running in nested guest mode attempts to block (e.g. due to
> HLT), kvm_check_nested_events() may return -EBUSY to indicate that a
> nested event is pending but cannot be injected immediately, such as
> when event delivery is temporarily blocked in the guest.
>
> Currently, vcpu_block() treats this as a generic error and exits to
> userspace. This can cause the vCPU to repeatedly block without making
> forward progress, delaying nested event injection and potentially
> leading to guest hangs under rare timing conditions.
>
> Handle -EBUSY explicitly by returning to the vCPU run loop and retrying
> guest entry instead of blocking. This allows nested event delivery to
> complete once the temporary blocking condition clears.
>
> This issue was triggered by syzkaller during nested virtualization
> stress testing.
>
> Fixes: 45405155d876 ("KVM: x86: WARN if a vCPU gets a valid wakeup
> that KVM can't yet inject")
> Reported-by: syzbot+1522459a74d26b0ac33a@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?id=b646ef310afe5b51ae0372e1de8fdd68baad9eb5
> Signed-off-by: Alessandro Ratti <alessandro@...5c.net>
> ---
>  arch/x86/kvm/x86.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index ff8812f3a129..d5cf9a7ff8c5 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -11596,7 +11596,15 @@ static inline int vcpu_block(struct kvm_vcpu *vcpu)
>         if (is_guest_mode(vcpu)) {
>                 int r = kvm_check_nested_events(vcpu);
>
> -               WARN_ON_ONCE(r == -EBUSY);
> +               /*
> +                * -EBUSY indicates a nested event is pending but cannot be
> +                * injected immediately (e.g., event delivery is temporarily
> +                * blocked). Return to the vCPU run loop to retry guest entry
> +                * instead of blocking, which would lose the pending event.
> +                */
> +               if (r == -EBUSY)
> +                       return 1;
> +
>                 if (r < 0)
>                         return 0;
>         }
> -- 
> 2.52.0