Re: kvm: BUG in pte_list_remove

[Wanpeng Li]

2017-03-24 0:42 GMT+08:00 Dmitry Vyukov <dvyukov@xxxxxxxxxx>:
> On Mon, Nov 14, 2016 at 10:43 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>> On Mon, Nov 14, 2016 at 10:34 AM, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote:
>>>
>>>
>>> On 14/11/2016 10:03, Dmitry Vyukov wrote:
>>>> Paolo,
>>>> can you please also commit this test to tools/testing? We are
>>>> frustrated by the situation that we reported hundreds of bugs with
>>>> reproducers, but exactly 0 kernel regression tests were added.
>>>
>>> Ok.  Last time I only put the reproducers in commit messages.  We can
>>> look into adding some KVM regression testing to tools/testing this time.
>>
>>
>> Tests in commit messages will be lost.
>> Growing a base of kernel regression tests will be great.
>>
>>
>>>> On Sun, Nov 13, 2016 at 5:00 PM, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote:
>>>>> Beautified source code:
>>>>>
>>>>> #include <fcntl.h>
>>>>> #include <pthread.h>
>>>>> #include <setjmp.h>
>>>>> #include <signal.h>
>>>>> #include <stddef.h>
>>>>> #include <stdint.h>
>>>>> #include <stdio.h>
>>>>> #include <stdlib.h>
>>>>> #include <string.h>
>>>>> #include <sys/ioctl.h>
>>>>> #include <sys/stat.h>
>>>>> #include <sys/syscall.h>
>>>>> #include <sys/types.h>
>>>>> #include <unistd.h>
>>>>> #include <linux/kvm.h>
>>>>>
>>>>> long r[16];
>>>>>
>>>>> int main()
>>>>> {
>>>>>   void *p = valloc(0x4000);
>>>>>
>>>>>   r[2] = open("/dev/kvm", 0);
>>>>>   r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
>>>>>
>>>>>   uint64_t addr = 0xf000;
>>>>>   ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
>>>>>   r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
>>>>>   ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
>>>>>   ioctl(r[6], KVM_RUN, 0);
>>>>>   ioctl(r[6], KVM_RUN, 0);
>>>>>
>>>>>   struct kvm_userspace_memory_region mr = {
>>>>>           .slot = 0,
>>>>>           .flags = KVM_MEM_LOG_DIRTY_PAGES,
>>>>>           .guest_phys_addr = 0xf000,
>>>>>           .memory_size = 0x4000,
>>>>>           .userspace_addr = (uintptr_t) p
>>>>>   };
>>>>>   ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
>>>>>   return 0;
>>>>> }
>
>
> This is still happens on a recent 093b995e3b55a0ae0670226ddfcb05bfbf0099ae:
>
>
> ------------[ cut here ]------------
> kernel BUG at arch/x86/kvm/mmu.c:1157!
> invalid opcode: 0000 [#1] SMP KASAN
> Modules linked in:
> CPU: 0 PID: 2966 Comm: a.out Not tainted 4.11.0-rc3+ #365
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff88006432a5c0 task.stack: ffff880064e48000
> RIP: 0010:pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156
> RSP: 0018:ffff880064e4eda0 EFLAGS: 00010282
> RAX: 0000000000000028 RBX: ffff88006ac72180 RCX: 0000000000000000
> RDX: 0000000000000028 RSI: 1ffff1000c9c9d72 RDI: ffffed000c9c9da8
> RBP: ffff880064e4ede0 R08: ffffed000da03dae R09: ffffed000da03dae
> R10: 0000000000000001 R11: ffffed000da03dad R12: 000000000000000f
> R13: 0000000000000000 R14: ffff88006bcd8ec0 R15: ffff88006bcd8ee8
> FS:  0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000000 CR3: 000000006870b000 CR4: 00000000001426f0
> Call Trace:
>  rmap_remove arch/x86/kvm/mmu.c:1233 [inline]
>  drop_spte+0x16c/0x270 arch/x86/kvm/mmu.c:1315
>  mmu_page_zap_pte+0x223/0x350 arch/x86/kvm/mmu.c:2427
>  kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2449 [inline]
>  kvm_mmu_prepare_zap_page+0x1bb/0x1260 arch/x86/kvm/mmu.c:2493
>  kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:5123 [inline]
>  kvm_mmu_invalidate_zap_all_pages+0x4a8/0x680 arch/x86/kvm/mmu.c:5164
>  kvm_arch_flush_shadow_all+0x15/0x20 arch/x86/kvm/x86.c:8370
>  kvm_mmu_notifier_release+0x71/0xb0
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:472
>  __mmu_notifier_release+0x1e5/0x6b0 mm/mmu_notifier.c:75
>  mmu_notifier_release include/linux/mmu_notifier.h:235 [inline]
>  exit_mmap+0x3a3/0x470 mm/mmap.c:2941
>  __mmput kernel/fork.c:894 [inline]
>  mmput+0x25e/0x790 kernel/fork.c:916
>  exit_mm kernel/exit.c:558 [inline]
>  do_exit+0xa51/0x26d0 kernel/exit.c:866
>  do_group_exit+0x149/0x400 kernel/exit.c:983
>  SYSC_exit_group kernel/exit.c:994 [inline]
>  SyS_exit_group+0x1d/0x20 kernel/exit.c:992
>  entry_SYSCALL_64_fastpath+0x1f/0xc2
> RIP: 0033:0x433609
> RSP: 002b:00007ffdbe967178 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000433609
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7
> R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000d7fbb0
> R13: 000000000001b411 R14: 0000000000002710 R15: 00000000006c08b8
> Code: 99 f9 5d 00 48 8b 75 d0 48 c7 c7 00 4a 42 84 e8 9c 13 72 00 0f
> 0b e8 82 f9 5d 00 48 8b 75 d0 48 c7 c7 c0 49 42 84 e8 85 13 72 00 <0f>
> 0b 4c 89 ef e8 78 14 8c 00 e9 01 fe ff ff 0f 1f 00 55 48 89
> RIP: pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156 RSP: ffff880064e4eda0
> ---[ end trace 2cf22c8ade550ee0 ]---
>
>
> #include <fcntl.h>
> #include <pthread.h>
> #include <setjmp.h>
> #include <signal.h>
> #include <stddef.h>
> #include <stdint.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/ioctl.h>
> #include <sys/stat.h>
> #include <sys/syscall.h>
> #include <sys/types.h>
> #include <unistd.h>
> #include <linux/kvm.h>
>
> long r[16];
>
> int main()
> {
>   void *p = valloc(0x4000);
>
>   r[2] = open("/dev/kvm", 0);
>   r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
>
>   uint64_t addr = 0xf000;
>   ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
>   r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
>   ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
>   ioctl(r[6], KVM_RUN, 0);
>   ioctl(r[6], KVM_RUN, 0);
>
>   struct kvm_userspace_memory_region mr = {
>           .slot = 0,
>           .flags = KVM_MEM_LOG_DIRTY_PAGES,
>           .guest_phys_addr = 0xf000,
>           .memory_size = 0x4000,
>           .userspace_addr = (uintptr_t) p
>   };
>   ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
>   return 0;
> }

I will take a look.