syzbot

 sign-in | mailing list | source | docs
🐞 Open [979] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12497] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in __apic_accept_irq

Status: fixed on 2019/10/15 23:40
Reported-by: syzbot+dff25ee91f0c7d5c1695@syzkaller.appspotmail.com
Fix commit: a073d7e3ad68 KVM: hyperv: Fix Direct Synthetic timers assert an interrupt w/o lapic_in_kernel
First crash: 1693d, last: 1680d
Cause bisection: introduced by (bisect log) :
commit 0aa67255f54df192d29aec7ac6abb1249d45bda7
Author: Vitaly Kuznetsov <vkuznets@redhat.com>
Date: Mon Nov 26 15:47:29 2018 +0000

  x86/hyper-v: move synic/stimer control structures definitions to hyperv-tlfs.h

Crash: no output from test machine (log)
Repro: C syz .config
  
▶ ▼ Discussions (9)
Title Replies (including bot) Last reply
[PATCH 5.3 000/166] 5.3.5-stable review 177 (177) 2019/11/12 19:42
[PATCH AUTOSEL 5.3 01/71] drivers: thermal: qcom: tsens: Fix memory leak from qfprom read 74 (74) 2019/10/09 03:45
[PATCH 5.2 000/137] 5.2.20-stable review 142 (142) 2019/10/07 16:24
[PATCH AUTOSEL 5.2 01/63] drivers: thermal: qcom: tsens: Fix memory leak from qfprom read 63 (63) 2019/10/01 16:41
Reminder: 4 active syzbot reports in kvm subsystem 1 (1) 2019/09/19 05:27
[PATCH v3] KVM: hyperv: Fix Direct Synthetic timers assert an interrupt w/o lapic_in_kernel 3 (3) 2019/09/17 13:38
[PATCH RESEND v3 1/5] KVM: LAPIC: Tune lapic_timer_advance_ns smoothly 6 (6) 2019/09/11 16:26
[PATCH] KVM: LAPIC: Fix SynIC Timers inject timer interrupt w/o LAPIC present 4 (4) 2019/09/11 16:25
general protection fault in __apic_accept_irq 3 (4) 2019/09/06 03:41
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in __apic_accept_irq (2) kvm C done 9 1399d 1395d 15/26 fixed on 2020/08/01 00:49

Sample crash report:
kvm [9865]: vcpu0, guest rIP: 0xcc Hyper-V uhandled wrmsr: 0x40000004 data 0x94
kvm [9865]: vcpu0, guest rIP: 0xcc Hyper-V uhandled wrmsr: 0x40000004 data 0x48c
kvm [9865]: vcpu0, guest rIP: 0xcc Hyper-V uhandled wrmsr: 0x40000004 data 0x4ac
kvm [9865]: vcpu0, guest rIP: 0xcc Hyper-V uhandled wrmsr: 0x40000005 data 0x1520
kvm [9865]: vcpu0, guest rIP: 0xcc Hyper-V uhandled wrmsr: 0x40000006 data 0x15d4
kvm [9865]: vcpu0, guest rIP: 0xcc Hyper-V uhandled wrmsr: 0x40000007 data 0x15c4
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9865 Comm: syz-executor239 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__apic_accept_irq+0x46/0xbc0 arch/x86/kvm/lapic.c:1029
Code: c0 44 89 45 d4 4c 89 4d c8 e8 96 db 5c 00 49 8d 86 98 00 00 00 48 89 c2 48 89 45 b8 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 65 0a 00 00 4d 8b be 98 00 00 00 0f 1f 44 00 00
RSP: 0018:ffff888091c37820 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888091c37958 RCX: 0000000000000000
RDX: 0000000000000013 RSI: ffffffff811599ba RDI: 0000000000000000
RBP: ffff888091c37878 R08: 0000000000000000 R09: 0000000000000000
R10: fffff52000be7870 R11: ffffc90005f3c383 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8880935d2ff0
FS:  000055555731a880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000a77ba000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 kvm_apic_set_irq+0x10b/0x170 arch/x86/kvm/lapic.c:558
 stimer_notify_direct arch/x86/kvm/hyperv.c:648 [inline]
 stimer_expiration arch/x86/kvm/hyperv.c:659 [inline]
 kvm_hv_process_stimers+0xd55/0x1a10 arch/x86/kvm/hyperv.c:686
 vcpu_enter_guest+0x4d2/0x5e90 arch/x86/kvm/x86.c:7896
 vcpu_run arch/x86/kvm/x86.c:8152 [inline]
 kvm_arch_vcpu_ioctl_run+0x464/0x1750 arch/x86/kvm/x86.c:8360
 kvm_vcpu_ioctl+0x4dc/0xfd0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2765
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0xdb6/0x13e0 fs/ioctl.c:696
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718
 do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x442a19
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 0c fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffd39fb6ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000442a19
RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
RBP: 00000000006cd018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000403ac0
R13: 0000000000403b50 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 3b2804fc9a2f7fff ]---
RIP: 0010:__apic_accept_irq+0x46/0xbc0 arch/x86/kvm/lapic.c:1029
Code: c0 44 89 45 d4 4c 89 4d c8 e8 96 db 5c 00 49 8d 86 98 00 00 00 48 89 c2 48 89 45 b8 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 65 0a 00 00 4d 8b be 98 00 00 00 0f 1f 44 00 00
RSP: 0018:ffff888091c37820 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888091c37958 RCX: 0000000000000000
RDX: 0000000000000013 RSI: ffffffff811599ba RDI: 0000000000000000
RBP: ffff888091c37878 R08: 0000000000000000 R09: 0000000000000000
R10: fffff52000be7870 R11: ffffc90005f3c383 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8880935d2ff0
FS:  000055555731a880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000a77ba000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (69):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/05 03:56 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-root
2019/09/05 03:45 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/09/05 03:19 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce
2019/09/05 03:17 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-root
2019/09/05 03:07 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/09/05 02:52 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/09/05 02:40 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce
2019/09/05 02:30 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-root
2019/09/05 02:26 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/09/05 02:17 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/09/05 02:00 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce
2019/09/05 01:52 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-root
2019/09/05 01:47 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/09/05 01:40 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/09/05 01:15 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-root
2019/09/05 01:13 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce
2019/09/05 01:10 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/09/05 01:04 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/09/05 00:32 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce
2019/09/05 00:28 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/09/04 23:53 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce
2019/09/04 23:53 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-root
2019/09/04 23:52 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/09/04 23:49 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-smack-root
2019/09/05 03:05 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/05 02:24 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/05 01:46 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/05 01:08 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/05 00:30 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/04 23:54 upstream 3b47fd5ca9ea 040fda58 .config console log report syz C ci-upstream-kasan-gce-386
2019/09/05 04:17 linux-next 6d028043b55e 040fda58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/09/05 03:34 linux-next 6d028043b55e 040fda58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/09/05 02:58 linux-next 6d028043b55e 040fda58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/09/05 02:22 linux-next 6d028043b55e 040fda58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/09/05 01:44 linux-next 6d028043b55e 040fda58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/09/04 23:51 linux-next 6d028043b55e 040fda58 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/09/14 06:01 upstream a7f89616b737 32d59357 .config console log report ci-upstream-kasan-gce-selinux-root
2019/09/07 12:01 upstream 1e3778cb223e a60cb4cd .config console log report ci-upstream-kasan-gce-smack-root
2019/09/06 21:15 upstream 044597100037 a60cb4cd .config console log report ci-upstream-kasan-gce-smack-root
2019/09/06 20:05 upstream 044597100037 a60cb4cd .config console log report ci-upstream-kasan-gce
2019/09/04 23:26 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-root
2019/09/04 23:16 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-smack-root
2019/09/04 23:14 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce
2019/09/04 23:14 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-root
2019/09/04 23:13 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce
2019/09/04 23:13 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-smack-root
2019/09/04 23:11 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-root
2019/09/04 23:11 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-smack-root
2019/09/04 23:10 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-selinux-root
2019/09/04 23:10 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce
2019/09/06 21:15 upstream 044597100037 a60cb4cd .config console log report ci-upstream-kasan-gce-386
2019/09/04 23:21 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-386
2019/09/04 23:13 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-386
2019/09/04 23:11 upstream 3b47fd5ca9ea 040fda58 .config console log report ci-upstream-kasan-gce-386
2019/09/17 21:32 linux-next f84e1c16f08d 13dcda9b .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/04 23:24 linux-next 6d028043b55e 040fda58 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/04 23:14 linux-next 6d028043b55e 040fda58 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/09/04 23:11 linux-next 6d028043b55e 040fda58 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.