Re: [syzbot] [kvm?] WARNING in kvm_vcpu_pre_fault_memory

[Sean Christopherson]

On Sun, Oct 04, 2026, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    ce1e0223d8ad Merge tag 'devicetree-fixes-for-7.3-2' of git..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1353dbf5580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=9d4242cb1c54cdf7
> dashboard link: https://syzkaller.appspot.com/bug?extid=db7bd0f41c2a7e82d4ba
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14cdf6c9580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12cdf6c9580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/217b0c1b14ee/disk-ce1e0223.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/335343cc5803/vmlinux-ce1e0223.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/760ef2f39df0/bzImage-ce1e0223.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+db7bd0f41c2a7e82d4ba@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> ------------[ cut here ]------------
> r == 0 || r == -EIO
> WARNING: arch/x86/kvm/../../../virt/kvm/kvm_main.c:4389 at kvm_vcpu_pre_fault_memory+0x45d/0x470 virt/kvm/kvm_main.c:4389, CPU#1: syz-executor267/8523
> Modules linked in:
> CPU: 1 UID: 0 PID: 8523 Comm: syz-executor267 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
> RIP: 0010:kvm_vcpu_pre_fault_memory+0x45d/0x470 virt/kvm/kvm_main.c:4389
> Code: fe ff ff e8 85 2e 88 00 90 0f 0b 90 e9 0d ff ff ff e8 77 2e 88 00 e8 42 85 f3 ff eb 8f e8 6b 2e 88 00 eb 05 e8 64 2e 88 00 90 <0f> 0b 90 e9 a7 fe ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90
> RSP: 0018:ffffc900024dfc28 EFLAGS: 00010293
> RAX: ffffffff813fe025 RBX: ffffc900024dfe00 RCX: ffff88807fcc0000
> RDX: 0000000000000000 RSI: ffffffff8eaf6510 RDI: fffffffffffffffb
> RBP: dffffc0000000000 R08: ffff88807fcc0000 R09: 0000000000000002
> R10: fffffffffffffffb R11: 0000000000000000 R12: ffffc900024dfe00
> R13: ffff88807fcc0000 R14: 1ffff1100ff98000 R15: fffffffffffffffb
> FS:  00007f9c411186c0(0000) GS:ffff888124dc7000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f9c4116312d CR3: 0000000026a4a000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  kvm_vcpu_ioctl+0x8a6/0xfd0 virt/kvm/kvm_main.c:4668
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:597 [inline]
>  __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f

I haven't tried the reproducer yet, but based on code inspection I'm pretty sure
the kvm_vm_dead() call in enter_smm() is colliding with commit 958810a09412d
("KVM: x86/mmu: Bail out kvm_tdp_map_page() when VM dead"), especialy since there
is SMM setup in the reproducer.

I'm think we can and should just drop EIO from the WARN.  It showed up in v5 of
the original series without any real explanation.  v5 did add -EIO as a documented
error code[1]:
  
  v4->v5:
    - add EIO as possible error

in response to Xiaoyao's review[2]:

  > +	case RET_PF_CONTINUE:
  > +	case RET_PF_INVALID:
  > +	default:
  > +		WARN_ON_ONCE(r);
  > +		return -EIO;
  
  Need to update patch 1 for -EIO
  
  > +	}


but AFAICT that was just talking about the documentation.  And at the time, KVM
x86 already WARNed when returning -EIO, so I've no idea common KVM also WARNed
on seeing -EIO.

[1] https://lore.kernel.org/all/20240710174031.312055-1-pbonzini@xxxxxxxxxx
[2] https://lore.kernel.org/all/d5a6e125-bff4-4d82-ae65-b99d9cb10e90@xxxxxxxxx