syzbot
general protection fault in kvm_cpuid
Status: fixed on 2017/10/24 22:03
Fix commit:
d1cd3ce90044
KVM: MMU: check guest CR3 reserved bits based on its physical address width.
First crash: 3261d, last: 3242d
Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 2983 Comm: syzkaller207407 Not tainted 4.13.0+ #77
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801cf78a480 task.stack: ffff8801cebb0000
RIP: 0010:kvm_cpuid+0xcf/0x8e0 arch/x86/kvm/cpuid.c:864
RSP: 0018:ffff8801cebb7088 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8801cebb7208 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8801cebb7208 RDI: ffff8801ce698040
RBP: ffff8801cebb7180 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: ffffed0039cd3551 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: dffffc0000000000
FS: 000000000141e880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020a74800 CR3: 00000001c0393000 CR4: 00000000001426e0
Call Trace:
emulator_get_cpuid+0x46/0x60 arch/x86/kvm/x86.c:5250
check_cr_write+0x379/0x7d0 arch/x86/kvm/emulate.c:4107
x86_emulate_insn+0x2940/0x3cf0 arch/x86/kvm/emulate.c:5404
x86_emulate_instruction+0x411/0x1ca0 arch/x86/kvm/x86.c:5735
emulate_instruction arch/x86/include/asm/kvm_host.h:1160 [inline]
handle_invalid_guest_state arch/x86/kvm/vmx.c:6563 [inline]
vmx_handle_exit+0x6d8/0x1a60 arch/x86/kvm/vmx.c:8775
vcpu_enter_guest arch/x86/kvm/x86.c:7038 [inline]
vcpu_run arch/x86/kvm/x86.c:7100 [inline]
kvm_arch_vcpu_ioctl_run+0x1d36/0x5a30 arch/x86/kvm/x86.c:7261
kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2550
vfs_ioctl fs/ioctl.c:45 [inline]
do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685
SYSC_ioctl fs/ioctl.c:700 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x443489
RSP: 002b:00007ffd2d62ee58 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000443489
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 0000000000000082 R08: 0000000000000000 R09: 00000000004002c8
R10: 0000000000000012 R11: 0000000000000206 R12: 0000000000009120
R13: 000000002aaaaaab R14: 0000000000000004 R15: 0000000020a71000
Code: 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 4d 06 00 00 8b 03 4c 89 e2 48 c1 ea 03 89 85 34 ff ff ff 48 b8 00 00 00 00 00 fc ff df <0f> b6 14 02 4c 89 e0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
RIP: kvm_cpuid+0xcf/0x8e0 arch/x86/kvm/cpuid.c:864 RSP: ffff8801cebb7088
---[ end trace cf9b92bb988d4a81 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
* Struck through repros no longer work on HEAD.