syzbot


kernel BUG at arch/x86/kvm/x86.c:LINE!

Status: fixed on 2018/03/12 10:10
Reported-by: syzbot+4facc37258a582d017ddb43934d4419891f41919@syzkaller.appspotmail.com
Fix commit: 61cb57c9ed63 KVM: x86: Exit to user-mode on #UD intercept when emulator requires
First crash: 2431d, last: 2331d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG at arch/x86/kvm/x86.c:LINE! (3) kvm 1 1867d 1866d 0/26 auto-closed as invalid on 2019/09/04 07:38
upstream kernel BUG at arch/x86/kvm/x86.c:LINE! (2) kvm C 193 1869d 2016d 0/26 closed as dup on 2018/10/11 14:32

Sample crash report:
------------[ cut here ]------------
kernel BUG at arch/x86/kvm/x86.c:7182!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3002 Comm: syz-executor0 Not tainted 4.14.0-rc1+ #89
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801ceb662c0 task.stack: ffff8801ceb08000
RIP: 0010:complete_emulated_mmio+0x5c2/0x6f0 arch/x86/kvm/x86.c:7182
RSP: 0018:ffff8801ceb0f620 EFLAGS: 00010297
RAX: ffff8801ceb662c0 RBX: ffff8801bfd48080 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8801bfd482b8
RBP: ffff8801ceb0f660 R08: 0000000000000000 R09: ffff8801ceb0ef70
R10: ffff8801ceb0fa58 R11: 1ffff10039d6ceeb R12: ffffffff810d57b0
R13: ffff8801d0e6d000 R14: ffff8801d2d73900 R15: ffff8801bfd48080
FS:  00007f47ba461700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001ceaa0000 CR4: 00000000001426f0
Call Trace:
 kvm_arch_vcpu_ioctl_run+0x2df5/0x5b90 arch/x86/kvm/x86.c:7261
 kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2551
 vfs_ioctl fs/ioctl.c:45 [inline]
 do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
 SYSC_ioctl fs/ioctl.c:700 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x451e59
RSP: 002b:00007f47ba460c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b7d9c
R13: 00000000ffffffff R14: 0000000020000000 R15: 0000000000fe5000
Code: 01 00 00 00 48 89 df e8 ad b2 47 00 44 89 e6 4c 89 f7 45 31 e4 e8 cf 55 4d 00 45 85 ed 41 0f 94 c4 e9 5f fc ff ff e8 ae 7a 60 00 <0f> 0b e8 a7 2c 95 00 e9 9c fa ff ff 89 45 c8 e8 9a 2c 95 00 8b 
RIP: complete_emulated_mmio+0x5c2/0x6f0 arch/x86/kvm/x86.c:7182 RSP: ffff8801ceb0f620
---[ end trace 906e7d1156cad69b ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (20):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/09/18 04:57 upstream 0666f560b71b 96b8e399 .config console log report syz ci-upstream-kasan-gce
2017/09/18 05:09 linux-next fc2e8b1a47c1 2bab8ad8 .config console log report syz skylake-linux-next-kasan-qemu
2017/09/18 05:03 linux-next fc2e8b1a47c1 2bab8ad8 .config console log report syz skylake-linux-next-kasan-qemu
2017/08/20 20:52 linux-next bb70832dd42b f238fbd4 .config console log report syz ci-upstream-next-kasan-gce
2017/11/18 08:57 net-next-old 1deab8ce2c91 84dd36ba .config console log report ci-upstream-kasan-gce
2017/09/18 04:39 upstream 0666f560b71b 96b8e399 .config console log report ci-upstream-kasan-gce
2017/11/29 02:22 upstream 43570f0383d6 34f2c233 .config console log report ci-upstream-kasan-gce-386
2017/11/13 16:33 upstream 516fb7f2e73d f9a8d567 .config console log report ci-upstream-kasan-gce-386
2017/11/07 10:29 upstream e4880bc5dfb1 d49979f7 .config console log report ci-upstream-kasan-gce-386
2017/11/03 06:24 upstream 5cb0512c02ec e930d6f6 .config console log report ci-upstream-kasan-gce-386
2017/10/26 19:21 upstream 4ed590271a65 6fd57ceb .config console log report ci-upstream-kasan-gce-386
2017/10/23 23:40 upstream 6cff0a118f23 92f543f0 .config console log report ci-upstream-kasan-gce-386
2017/10/20 11:34 upstream ce43f4fd6f10 4d9c0713 .config console log report ci-upstream-kasan-gce-386
2017/11/18 04:00 linux-next ee92513eae01 9badd053 .config console log report ci-upstream-next-kasan-gce
2017/11/18 00:05 linux-next ee92513eae01 9badd053 .config console log report ci-upstream-next-kasan-gce
2017/11/05 01:39 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
2017/09/19 05:15 linux-next 840cc455c5f5 92f543f0 .config console log report ci-upstream-next-kasan-gce
2017/09/19 04:49 linux-next 840cc455c5f5 92f543f0 .config console log report ci-upstream-next-kasan-gce
2017/08/27 05:00 linux-next 7159188b70e3 4074aed7 .config console log report ci-upstream-next-kasan-gce
2017/08/20 20:47 linux-next bb70832dd42b f238fbd4 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.