syzbot

 sign-in | mailing list | source | docs
🐞 Open [987] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12505] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in kvm_coalesced_mmio_init

Status: fixed on 2019/11/29 15:48
Subsystems: kvm
[Documentation on labels]
Reported-by: syzbot+e27e7027eb2b80e44225@syzkaller.appspotmail.com
Fix commit: 8a44119a98be KVM: Fix NULL-ptr deref after kvm_create_vm fails
First crash: 1635d, last: 1625d
Cause bisection: introduced by (bisect log) :
commit 9121923c457d1d8667a6e3a67302c29e5c5add6b
Author: Jim Mattson <jmattson@google.com>
Date: Thu Oct 24 23:03:26 2019 +0000

  kvm: Allocate memslots and buses before calling kvm_arch_init_vm

Crash: general protection fault in kvm_coalesced_mmio_init (log)
Repro: syz .config
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH 0/2] KVM: fix issues with kvm_create_vm failures 6 (6) 2019/11/12 18:50
general protection fault in kvm_coalesced_mmio_init 0 (3) 2019/11/10 18:22

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 20263 Comm: syz-executor.2 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kvm_coalesced_mmio_init+0x59/0xf0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:121
Code: 00 00 00 fc ff df e8 46 7d 6b 00 48 c1 e3 06 49 be 00 00 00 00 80 08 05 00 49 01 de 49 8d bf d8 96 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 bb bb a4 00 4d 89 b7 d8 96 00 00 49 8d bf
RSP: 0018:ffff888091647d10 EFLAGS: 00010206
RAX: 00000000000012db RBX: fffa80009cb1b000 RCX: ffff8880a42d21c0
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 00000000000096d8
RBP: ffff888091647d30 R08: ffffffff83486eda R09: ffffed1015d46b05
R10: ffffed1015d46b05 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88809cb1b000 R15: 0000000000000000
FS:  00007fb51eb61700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa986fb7000 CR3: 000000009c69d000 CR4: 00000000001426f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:3448 [inline]
 kvm_dev_ioctl+0x18fa/0x1fd0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3496
 do_vfs_ioctl+0x744/0x1730 fs/ioctl.c:46
 ksys_ioctl fs/ioctl.c:713 [inline]
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0xe3/0x120 fs/ioctl.c:718
 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a219
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fb51eb60c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219
RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000004
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb51eb616d4
R13: 00000000004c348b R14: 00000000004d7708 R15: 00000000ffffffff
Modules linked in:
---[ end trace 15ab0f35a80c9e5d ]---
RIP: 0010:kvm_coalesced_mmio_init+0x59/0xf0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:121
Code: 00 00 00 fc ff df e8 46 7d 6b 00 48 c1 e3 06 49 be 00 00 00 00 80 08 05 00 49 01 de 49 8d bf d8 96 00 00 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 bb bb a4 00 4d 89 b7 d8 96 00 00 49 8d bf
RSP: 0018:ffff888091647d10 EFLAGS: 00010206
RAX: 00000000000012db RBX: fffa80009cb1b000 RCX: ffff8880a42d21c0
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 00000000000096d8
RBP: ffff888091647d30 R08: ffffffff83486eda R09: ffffed1015d46b05
R10: ffffed1015d46b05 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88809cb1b000 R15: 0000000000000000
FS:  00007fb51eb61700(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000625208 CR3: 000000009c69d000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (48):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/10 13:55 upstream 00aff6836241 dc438b91 .config console log report syz ci-upstream-kasan-gce-smack-root
2019/11/13 07:29 upstream 100d46bd72ec 048f2d49 .config console log report ci-upstream-kasan-gce
2019/11/12 22:07 upstream 100d46bd72ec 048f2d49 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/12 15:38 upstream de620fb99ef2 048f2d49 .config console log report ci-upstream-kasan-gce-root
2019/11/12 14:01 upstream de620fb99ef2 048f2d49 .config console log report ci-upstream-kasan-gce-selinux-root
2019/11/12 01:55 upstream 31f4f5b495a6 048f2d49 .config console log report ci-upstream-kasan-gce-root
2019/11/12 00:24 upstream 31f4f5b495a6 048f2d49 .config console log report ci-upstream-kasan-gce-selinux-root
2019/11/11 14:35 upstream 9805a68371ce dc438b91 .config console log report ci-upstream-kasan-gce-root
2019/11/11 10:52 upstream 9805a68371ce dc438b91 .config console log report ci-upstream-kasan-gce-root
2019/11/11 07:38 upstream 9805a68371ce dc438b91 .config console log report ci-upstream-kasan-gce-selinux-root
2019/11/11 06:54 upstream 9805a68371ce dc438b91 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/11 05:07 upstream 9805a68371ce dc438b91 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/10 17:44 upstream 00aff6836241 dc438b91 .config console log report ci-upstream-kasan-gce-selinux-root
2019/11/10 16:30 upstream 00aff6836241 dc438b91 .config console log report ci-upstream-kasan-gce-root
2019/11/10 15:09 upstream 00aff6836241 dc438b91 .config console log report ci-upstream-kasan-gce-selinux-root
2019/11/10 15:03 upstream 00aff6836241 dc438b91 .config console log report ci-upstream-kasan-gce-selinux-root
2019/11/10 01:16 upstream 0058b0a506e4 dc438b91 .config console log report ci-upstream-kasan-gce-root
2019/11/10 00:44 upstream 0058b0a506e4 dc438b91 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/09 08:21 upstream 6737e7634951 dc438b91 .config console log report ci-upstream-kasan-gce
2019/11/09 04:46 upstream 6737e7634951 dc438b91 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/09 00:48 upstream 6737e7634951 dc438b91 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/08 22:12 upstream 6737e7634951 1e35461e .config console log report ci-upstream-kasan-gce-smack-root
2019/11/08 07:01 upstream 847120f859cc f39aff9e .config console log report ci-upstream-kasan-gce-root
2019/11/08 03:57 upstream 847120f859cc f39aff9e .config console log report ci-upstream-kasan-gce-smack-root
2019/11/08 00:22 upstream 847120f859cc f39aff9e .config console log report ci-upstream-kasan-gce-root
2019/11/07 12:17 upstream 4dd58158254c d797d201 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/07 00:48 upstream 26bc67213424 da505f84 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/06 23:28 upstream 26bc67213424 da505f84 .config console log report ci-upstream-kasan-gce-root
2019/11/06 18:07 upstream 26bc67213424 da505f84 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/05 20:42 upstream a99d8080aaf3 0f3ec414 .config console log report ci-upstream-kasan-gce-root
2019/11/05 16:26 upstream a99d8080aaf3 0f3ec414 .config console log report ci-upstream-kasan-gce
2019/11/05 01:04 upstream a99d8080aaf3 76630fc9 .config console log report ci-upstream-kasan-gce-root
2019/11/04 10:21 upstream a99d8080aaf3 b35fad31 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/04 07:28 upstream a99d8080aaf3 b35fad31 .config console log report ci-upstream-kasan-gce-root
2019/11/04 05:05 upstream a99d8080aaf3 b35fad31 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/03 20:43 upstream 56cfd2507d3e c9610487 .config console log report ci-upstream-kasan-gce-smack-root
2019/11/03 07:06 upstream 9d2345057538 a41ca8fa .config console log report ci-upstream-kasan-gce-smack-root
2019/11/03 01:42 upstream 9d2345057538 a41ca8fa .config console log report ci-upstream-kasan-gce-root
2019/11/12 03:21 linux-next 6980b7f6f9db 048f2d49 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/12 00:53 linux-next 6980b7f6f9db 048f2d49 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/09 05:50 linux-next 5591cf003452 dc438b91 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/08 21:28 linux-next 5591cf003452 1e35461e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/08 07:43 linux-next c68c5373c504 f39aff9e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/07 22:37 linux-next c68c5373c504 f39aff9e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/06 17:03 linux-next dcd34bd23418 da505f84 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/06 16:04 linux-next dcd34bd23418 da505f84 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/11/05 13:52 linux-next 51309b9d73f5 0f3ec414 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.