On Fri, Apr 26, 2019 at 09:34:01AM -0700, Zubin Mithra wrote:
From: Paolo Bonzini pbonzini@redhat.com
commit 78e546c824fa8f96d323b7edd6f5cad5b74af057 upstream
This cannot be returned by KVM_GET_VCPU_EVENTS, so it is okay to return EINVAL. It causes a WARN from exception_type:
WARNING: CPU: 3 PID: 16732 at arch/x86/kvm/x86.c:345 exception_type+0x49/0x50 [kvm]() CPU: 3 PID: 16732 Comm: a.out Tainted: G W 4.4.6-300.fc23.x86_64 #1 Hardware name: LENOVO 2325F51/2325F51, BIOS G2ET32WW (1.12 ) 05/30/2012 0000000000000286 000000006308a48b ffff8800bec7fcf8 ffffffff813b542e 0000000000000000 ffffffffa0966496 ffff8800bec7fd30 ffffffff810a40f2 ffff8800552a8000 0000000000000000 00000000002c267c 0000000000000001 Call Trace: [<ffffffff813b542e>] dump_stack+0x63/0x85 [<ffffffff810a40f2>] warn_slowpath_common+0x82/0xc0 [<ffffffff810a423a>] warn_slowpath_null+0x1a/0x20 [<ffffffffa0924809>] exception_type+0x49/0x50 [kvm] [<ffffffffa0934622>] kvm_arch_vcpu_ioctl_run+0x10a2/0x14e0 [kvm] [<ffffffffa091c04d>] kvm_vcpu_ioctl+0x33d/0x620 [kvm] [<ffffffff81241248>] do_vfs_ioctl+0x298/0x480 [<ffffffff812414a9>] SyS_ioctl+0x79/0x90 [<ffffffff817a04ee>] entry_SYSCALL_64_fastpath+0x12/0x71 ---[ end trace b1a0391266848f50 ]---
Testcase (beautified/reduced from syzkaller output):
#include <unistd.h> #include <sys/syscall.h> #include <string.h> #include <stdint.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/kvm.h>
long r[31];
int main() { memset(r, -1, sizeof(r)); r[2] = open("/dev/kvm", O_RDONLY); r[3] = ioctl(r[2], KVM_CREATE_VM, 0); r[7] = ioctl(r[3], KVM_CREATE_VCPU, 0);
struct kvm_vcpu_events ve = { .exception.injected = 1, .exception.nr = 0xd4 }; r[27] = ioctl(r[7], KVM_SET_VCPU_EVENTS, &ve); r[30] = ioctl(r[7], KVM_RUN, 0); return 0;}
Reported-by: Dmitry Vyukov dvyukov@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Radim Krčmář rkrcmar@redhat.com Signed-off-by: Zubin Mithra zsm@chromium.org
Notes:
- Syzkaller triggered a WARNING in exception_type with the following stacktrace.
Call Trace: __dump_stack lib/dump_stack.c:15 [inline] dump_stack+0xbf/0x113 lib/dump_stack.c:51 panic+0x1a6/0x361 kernel/panic.c:116 __warn+0x168/0x1b0 kernel/panic.c:470 warn_slowpath_null+0x3c/0x40 kernel/panic.c:514 exception_type+0x33/0x7d arch/x86/kvm/x86.c:354 inject_pending_event arch/x86/kvm/x86.c:6072 [inline] vcpu_enter_guest arch/x86/kvm/x86.c:6551 [inline] vcpu_run arch/x86/kvm/x86.c:6744 [inline] kvm_arch_vcpu_ioctl_run+0x1b76/0x352e arch/x86/kvm/x86.c:6902 kvm_vcpu_ioctl+0x396/0xa74 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2432 vfs_ioctl fs/ioctl.c:43 [inline] do_vfs_ioctl+0xcb0/0xd0f fs/ioctl.c:630 SYSC_ioctl fs/ioctl.c:645 [inline] SyS_ioctl+0x71/0xad fs/ioctl.c:636 entry_SYSCALL_64_fastpath+0x31/0xb3
- This patch resolves a conflict that arises when applying the original upstream
commit. The conflict arises as the following upstream patch was applied to 4.4.y: 28bf28887976 ("KVM: x86: fix user triggerable warning in kvm_apic_accept_events()")
This commit is present in linux-4.9.y
Tests run: Chrome OS tryjobs, Syzkaller reproducer
Queued, thanks!
-- Thanks, Sasha