kvm: BUG in pte_list_remove

[Dmitry Vyukov]

Hello,

The following program triggers BUG in pte_list_remove:
https://gist.githubusercontent.com/dvyukov/c763720296f6f4e51934c58ade173a71/raw/2f78e3e634dcd8c3d39d2fbbdcd2afb02bc736f5/gistfile1.txt

On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (nov 11)

kernel BUG at arch/x86/kvm/mmu.c:1016!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 1923 Comm: syz-executor Not tainted 4.9.0-rc4+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88003744c480 task.stack: ffff88003bcc8000
RIP: 0010:[<ffffffff810c6996>]  [<ffffffff810c6996>]
pte_list_remove+0x3a6/0x3f0 arch/x86/kvm/mmu.c:1015
RSP: 0018:ffff88003bccf660  EFLAGS: 00010286
RAX: 0000000000000028 RBX: ffff88003c2f5d68 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 0000000000000001 RDI: ffffed0007799ec0
RBP: ffff88003bccf6a0 R08: 0000000000000001 R09: 0000000000000000
R10: ffffffff84da2600 R11: 0000000000000001 R12: ffff88003763aa08
R13: 0000000000000000 R14: 000000000000000f R15: ffff88003763aa30
FS:  00007f5cac039700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e0000 CR3: 000000003ba9a000 CR4: 00000000000026f0
DR0: 000000000000e3f1 DR1: 0000000000000006 DR2: 0000000000000006
DR3: 0000000000000458 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Stack:
 ffff88003c2f5d68 0000000000000001 ffff88003dd43078 ffff88003dd43078
 ffff88003763aa08 ffff88003d70c000 000000000000000f ffff88003763aa30
 ffff88003bccf6e0 ffffffff810d1eb6 ffff88003744c480 0000000037d8cc77
Call Trace:
 [<     inline     >] rmap_remove arch/x86/kvm/mmu.c:1092
 [<ffffffff810d1eb6>] drop_spte+0x166/0x260 arch/x86/kvm/mmu.c:1174
 [<ffffffff810d267d>] mmu_page_zap_pte+0x19d/0x1e0 arch/x86/kvm/mmu.c:2295
 [<     inline     >] kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2317
 [<ffffffff810d9486>] kvm_mmu_prepare_zap_page+0x126/0xd60
arch/x86/kvm/mmu.c:2361
 [<     inline     >] kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:4904
 [<ffffffff810eb1d4>] kvm_mmu_invalidate_zap_all_pages+0x2d4/0x490
arch/x86/kvm/mmu.c:4945
 [<ffffffff810b8055>] kvm_arch_flush_shadow_all+0x15/0x20
arch/x86/kvm/x86.c:8152
 [<ffffffff81059d91>] kvm_mmu_notifier_release+0x71/0xb0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:467
 [<ffffffff8164fe61>] __mmu_notifier_release+0x101/0x3e0 mm/mmu_notifier.c:74
 [<     inline     >] mmu_notifier_release include/linux/mmu_notifier.h:235
 [<ffffffff815fe1dc>] exit_mmap+0x32c/0x3d0 mm/mmap.c:2918
 [<     inline     >] __mmput kernel/fork.c:866
 [<ffffffff812345c5>] mmput+0x95/0x300 kernel/fork.c:888
 [<     inline     >] exit_mm kernel/exit.c:512
 [<ffffffff8124885d>] do_exit+0x71d/0x2bc0 kernel/exit.c:815
 [<ffffffff8124efa8>] do_group_exit+0x108/0x330 kernel/exit.c:931
 [<ffffffff81271117>] get_signal+0x617/0x1780 kernel/signal.c:2307
 [<ffffffff8118294d>] do_signal+0x8d/0x19d0 arch/x86/kernel/signal.c:807
 [<ffffffff810039f7>] exit_to_usermode_loop+0xf7/0x150
arch/x86/entry/common.c:156
 [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190
 [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0
arch/x86/entry/common.c:259
 [<ffffffff831f0e62>] entry_SYSCALL_64_fastpath+0xc0/0xc2
Code: 71 71 39 00 48 8b 75 d0 48 c7 c7 40 3e 22 83 e8 6a 07 48 00 0f
0b e8 5a 71 39 00 48 8b 75 d0 48 c7 c7 00 3e 22 83 e8 53 07 48 00 <0f>
0b e8 63 48 59 00 e9 c1 fe ff ff e8 f9 48 59 00 e9 4a ff ff
RIP  [<ffffffff810c6996>] pte_list_remove+0x3a6/0x3f0 arch/x86/kvm/mmu.c:1015
 RSP <ffff88003bccf660>
---[ end trace 1cbf703067869156 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1