syzbot


kernel BUG in vhost_get_vq_desc

Status: upstream: reported C repro on 2022/02/12 22:47
Reported-by: syzbot+3140b17cb44a7b174008@syzkaller.appspotmail.com
Fix commit: a58da53ffd70 vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 154d, last: 123d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in vhost_dev_cleanup (log)
Repro: C syz .config
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 kernel BUG in vhost_get_vq_desc C error done 19 107d 151d 2/3 fixed on 2022/05/13 02:56
android-54 kernel BUG in vhost_get_vq_desc C 4 91d 131d 0/2 upstream: reported C repro on 2022/02/17 22:45
linux-4.14 kernel BUG in vhost_get_vq_desc C 1 6d10h 126d 0/1 upstream: reported C repro on 2022/02/22 17:48
upstream kernel BUG at drivers/vhost/vhost.c:LINE! (2) C 139 1513d 1544d 6/22 fixed on 2018/05/08 18:30
upstream kernel BUG at drivers/vhost/vhost.c:LINE! C 152 1544d 1563d 6/22 fixed on 2018/04/06 16:37
Patch testing requests:
Created Duration User Patch Repo Result
2022/03/02 08:56 12m sgarzare@redhat.com https://github.com/stefano-garzarella/linux.git vsock-fix-stop OK
2022/02/22 03:11 11m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b OK
2022/02/22 00:15 10m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/21 14:10 11m sgarzare@redhat.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b OK
2022/02/21 14:06 7m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b error
2022/02/21 12:50 11m sgarzare@redhat.com https://github.com/stefano-garzarella/linux.git vsock-fix-stop OK
2022/02/21 08:52 13m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/21 05:41 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/21 04:07 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/21 02:12 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/20 13:10 9m mst@redhat.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/20 01:47 12m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b OK
2022/02/19 12:51 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/19 11:49 8m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log

Sample crash report:
------------[ cut here ]------------
kernel BUG at drivers/vhost/vhost.c:2335!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3597 Comm: vhost-3596 Not tainted 5.17.0-rc4-syzkaller-00054-gf71077a4d84b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:vhost_get_vq_desc+0x1d43/0x22c0 drivers/vhost/vhost.c:2335
Code: 00 00 00 48 c7 c6 20 2c 9d 8a 48 c7 c7 98 a6 8e 8d 48 89 ca 48 c1 e1 04 48 01 d9 e8 b7 59 28 fd e9 74 ff ff ff e8 5d c8 a1 fa <0f> 0b e8 56 c8 a1 fa 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90001d1fb88 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff8880234b0000 RSI: ffffffff86d715c3 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff86d706bc R11: 0000000000000000 R12: ffff888072c24d68
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888072c24bb0
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 000000007902c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 vhost_vsock_handle_tx_kick+0x277/0xa20 drivers/vhost/vsock.c:522
 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vhost_get_vq_desc+0x1d43/0x22c0 drivers/vhost/vhost.c:2335
Code: 00 00 00 48 c7 c6 20 2c 9d 8a 48 c7 c7 98 a6 8e 8d 48 89 ca 48 c1 e1 04 48 01 d9 e8 b7 59 28 fd e9 74 ff ff ff e8 5d c8 a1 fa <0f> 0b e8 56 c8 a1 fa 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90001d1fb88 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff8880234b0000 RSI: ffffffff86d715c3 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff86d706bc R11: 0000000000000000 R12: ffff888072c24d68
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888072c24bb0
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 000000007902c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (19):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce 2022/02/18 01:20 upstream f71077a4d84b 3cd800e4 .config log report syz C kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-root 2022/02/25 12:50 upstream 73878e5eb1bd 7c337266 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce 2022/02/24 19:29 upstream 23d04328444a b28851a4 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-selinux-root 2022/02/23 21:50 upstream 5c1ee569660d 6e821dbf .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-selinux-root 2022/02/23 06:57 upstream 917bbdb107f8 6e821dbf .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-root 2022/02/21 18:25 upstream cfb92440ee71 3cd800e4 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce 2022/02/17 07:01 upstream 359303076163 2bea8a27 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-smack-root 2022/02/17 06:46 upstream 359303076163 2bea8a27 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-selinux-root 2022/02/16 05:29 upstream 705d84a366cf 8b9ca619 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-selinux-root 2022/02/13 09:15 upstream b81b1829e7e3 8b9ca619 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-selinux-root 2022/02/12 22:47 upstream 83e396641110 8b9ca619 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce-smack-root 2022/02/11 01:44 upstream e3c85076d7a6 0b33604d .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce 2022/02/08 05:36 upstream 555f3d7be91a a7dab638 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce 2022/02/05 03:32 upstream dcb85f85fa6f e13a05ed .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-kasan-gce 2022/01/26 05:25 upstream 0280e3c58f92 2cbffd88 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-linux-next-kasan-gce-root 2022/02/20 12:14 linux-next ef6b35306dd8 3cd800e4 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-linux-next-kasan-gce-root 2022/02/17 06:56 linux-next ef6b35306dd8 2bea8a27 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-linux-next-kasan-gce-root 2022/02/16 05:29 linux-next ef6b35306dd8 8b9ca619 .config log report info kernel BUG in vhost_get_vq_desc
ci-upstream-linux-next-kasan-gce-root 2022/02/14 23:32 linux-next ef6b35306dd8 8b9ca619 .config log report info kernel BUG in vhost_get_vq_desc