kvm: GPF in irqfd_shutdown/eventfd_ctx_remove_wait_queue

[Dmitry Vyukov]

Hello,

I've got the following crash while running syzkaller fuzzer.
On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11).
Unfortunately it is not reproducible.
May be related to:
https://groups.google.com/forum/#!topic/syzkaller/NKlClJzOOww
https://groups.google.com/forum/#!topic/syzkaller/Dz__GySpVr8

general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 17194 Comm: kworker/0:2 Not tainted 4.9.0-rc4+ #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: kvm-irqfd-cleanup irqfd_shutdown
task: ffff88003b2bdb40 task.stack: ffff88003bcd8000
RIP: 0010:[<ffffffff8175b8e9>]  [<     inline     >] __list_del
include/linux/list.h:89
RIP: 0010:[<ffffffff8175b8e9>]  [<     inline     >] list_del
include/linux/list.h:107
RIP: 0010:[<ffffffff8175b8e9>]  [<     inline     >]
__remove_wait_queue include/linux/wait.h:196
RIP: 0010:[<ffffffff8175b8e9>]  [<ffffffff8175b8e9>]
eventfd_ctx_remove_wait_queue+0x139/0x2d0 fs/eventfd.c:201
RSP: 0018:ffff88003bcdfb50  EFLAGS: 00010002
RAX: 0000000000000000 RBX: ffff88003cefbd40 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008
RBP: ffff88003bcdfb90 R08: 0000000090a58b45 R09: 0000000000000001
R10: ffffffff84da2600 R11: 1ffff1000779bf36 R12: ffff88003b986b88
R13: ffff88003bcdfbc8 R14: ffff88003cefbd48 R15: 0000000000000081
FS:  0000000000000000(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000813000 CR3: 0000000065fd4000 CR4: 00000000000026f0
Stack:
 ffff88003bcdfb60 ffff88003cefbd90 0000000000000296 ffff88003b986b80
 ffff88003b986ca8 1ffff1000779bf75 ffff88003b986c80 dffffc0000000000
 ffff88003bcdfc30 ffffffff8106dd86 0000000000000000 0000000041b58ab3
Call Trace:
 [<ffffffff8106dd86>] irqfd_shutdown+0x96/0x1a0
arch/x86/kvm/../../../virt/kvm/eventfd.c:128
 [<ffffffff8129175c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096
 [<ffffffff8129274f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230
 [<ffffffff812a5a94>] kthread+0x244/0x2d0 kernel/kthread.c:209
 [<ffffffff831f102a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
Code: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 83 01 00 00 48 8d 7a 08
48 b9 00 00 00 00 00 fc ff df 49 8b 44 24 20 48 89 fe 48 c1 ee 03 <80>
3c 0e 00 0f 85 45 01 00 00 48 89 c6 48 b9 00 00 00 00 00 fc
RIP  [<     inline     >] __list_del include/linux/list.h:89
RIP  [<     inline     >] list_del include/linux/list.h:107
RIP  [<     inline     >] __remove_wait_queue include/linux/wait.h:196
RIP  [<ffffffff8175b8e9>] eventfd_ctx_remove_wait_queue+0x139/0x2d0
fs/eventfd.c:201
 RSP <ffff88003bcdfb50>
---[ end trace 9772f974e210aab6 ]---
Kernel panic - not syncing: Fatal exception
Shutting down cpus with NMI
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
reboot: cpu_has_vmx: ecx=80a02021 1