Re: kvm: BUG in pte_list_remove

[Dmitry Vyukov]

On Mon, Nov 14, 2016 at 10:43 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
> On Mon, Nov 14, 2016 at 10:34 AM, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote:
>>
>>
>> On 14/11/2016 10:03, Dmitry Vyukov wrote:
>>> Paolo,
>>> can you please also commit this test to tools/testing? We are
>>> frustrated by the situation that we reported hundreds of bugs with
>>> reproducers, but exactly 0 kernel regression tests were added.
>>
>> Ok.  Last time I only put the reproducers in commit messages.  We can
>> look into adding some KVM regression testing to tools/testing this time.
>
>
> Tests in commit messages will be lost.
> Growing a base of kernel regression tests will be great.
>
>
>>> On Sun, Nov 13, 2016 at 5:00 PM, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote:
>>>> Beautified source code:
>>>>
>>>> #include <fcntl.h>
>>>> #include <pthread.h>
>>>> #include <setjmp.h>
>>>> #include <signal.h>
>>>> #include <stddef.h>
>>>> #include <stdint.h>
>>>> #include <stdio.h>
>>>> #include <stdlib.h>
>>>> #include <string.h>
>>>> #include <sys/ioctl.h>
>>>> #include <sys/stat.h>
>>>> #include <sys/syscall.h>
>>>> #include <sys/types.h>
>>>> #include <unistd.h>
>>>> #include <linux/kvm.h>
>>>>
>>>> long r[16];
>>>>
>>>> int main()
>>>> {
>>>>   void *p = valloc(0x4000);
>>>>
>>>>   r[2] = open("/dev/kvm", 0);
>>>>   r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
>>>>
>>>>   uint64_t addr = 0xf000;
>>>>   ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
>>>>   r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
>>>>   ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
>>>>   ioctl(r[6], KVM_RUN, 0);
>>>>   ioctl(r[6], KVM_RUN, 0);
>>>>
>>>>   struct kvm_userspace_memory_region mr = {
>>>>           .slot = 0,
>>>>           .flags = KVM_MEM_LOG_DIRTY_PAGES,
>>>>           .guest_phys_addr = 0xf000,
>>>>           .memory_size = 0x4000,
>>>>           .userspace_addr = (uintptr_t) p
>>>>   };
>>>>   ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
>>>>   return 0;
>>>> }


This is still happens on a recent 093b995e3b55a0ae0670226ddfcb05bfbf0099ae:


------------[ cut here ]------------
kernel BUG at arch/x86/kvm/mmu.c:1157!
invalid opcode: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 0 PID: 2966 Comm: a.out Not tainted 4.11.0-rc3+ #365
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006432a5c0 task.stack: ffff880064e48000
RIP: 0010:pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156
RSP: 0018:ffff880064e4eda0 EFLAGS: 00010282
RAX: 0000000000000028 RBX: ffff88006ac72180 RCX: 0000000000000000
RDX: 0000000000000028 RSI: 1ffff1000c9c9d72 RDI: ffffed000c9c9da8
RBP: ffff880064e4ede0 R08: ffffed000da03dae R09: ffffed000da03dae
R10: 0000000000000001 R11: ffffed000da03dad R12: 000000000000000f
R13: 0000000000000000 R14: ffff88006bcd8ec0 R15: ffff88006bcd8ee8
FS:  0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000006870b000 CR4: 00000000001426f0
Call Trace:
 rmap_remove arch/x86/kvm/mmu.c:1233 [inline]
 drop_spte+0x16c/0x270 arch/x86/kvm/mmu.c:1315
 mmu_page_zap_pte+0x223/0x350 arch/x86/kvm/mmu.c:2427
 kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2449 [inline]
 kvm_mmu_prepare_zap_page+0x1bb/0x1260 arch/x86/kvm/mmu.c:2493
 kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:5123 [inline]
 kvm_mmu_invalidate_zap_all_pages+0x4a8/0x680 arch/x86/kvm/mmu.c:5164
 kvm_arch_flush_shadow_all+0x15/0x20 arch/x86/kvm/x86.c:8370
 kvm_mmu_notifier_release+0x71/0xb0
arch/x86/kvm/../../../virt/kvm/kvm_main.c:472
 __mmu_notifier_release+0x1e5/0x6b0 mm/mmu_notifier.c:75
 mmu_notifier_release include/linux/mmu_notifier.h:235 [inline]
 exit_mmap+0x3a3/0x470 mm/mmap.c:2941
 __mmput kernel/fork.c:894 [inline]
 mmput+0x25e/0x790 kernel/fork.c:916
 exit_mm kernel/exit.c:558 [inline]
 do_exit+0xa51/0x26d0 kernel/exit.c:866
 do_group_exit+0x149/0x400 kernel/exit.c:983
 SYSC_exit_group kernel/exit.c:994 [inline]
 SyS_exit_group+0x1d/0x20 kernel/exit.c:992
 entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x433609
RSP: 002b:00007ffdbe967178 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000433609
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7
R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000d7fbb0
R13: 000000000001b411 R14: 0000000000002710 R15: 00000000006c08b8
Code: 99 f9 5d 00 48 8b 75 d0 48 c7 c7 00 4a 42 84 e8 9c 13 72 00 0f
0b e8 82 f9 5d 00 48 8b 75 d0 48 c7 c7 c0 49 42 84 e8 85 13 72 00 <0f>
0b 4c 89 ef e8 78 14 8c 00 e9 01 fe ff ff 0f 1f 00 55 48 89
RIP: pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156 RSP: ffff880064e4eda0
---[ end trace 2cf22c8ade550ee0 ]---


#include <fcntl.h>
#include <pthread.h>
#include <setjmp.h>
#include <signal.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/kvm.h>

long r[16];

int main()
{
  void *p = valloc(0x4000);

  r[2] = open("/dev/kvm", 0);
  r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);

  uint64_t addr = 0xf000;
  ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
  r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
  ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
  ioctl(r[6], KVM_RUN, 0);
  ioctl(r[6], KVM_RUN, 0);

  struct kvm_userspace_memory_region mr = {
          .slot = 0,
          .flags = KVM_MEM_LOG_DIRTY_PAGES,
          .guest_phys_addr = 0xf000,
          .memory_size = 0x4000,
          .userspace_addr = (uintptr_t) p
  };
  ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
  return 0;
}