audit: type=1400 audit(1550995132.442:37): avc: denied { associate } for pid=8025 comm="syz-executor181" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. ------------[ cut here ]------------ kernel BUG at arch/x86/kvm/x86.c:357! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8041 Comm: syz-executor181 Not tainted 5.0.0-rc7+ #85 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kvm_spurious_fault+0x9/0x10 arch/x86/kvm/x86.c:357 Code: e8 9c ce 65 00 41 bd 03 00 00 00 5b 44 89 e8 41 5c 41 5d 5d c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e8 77 ce 65 00 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 41 55 41 54 RSP: 0018:ffff8880ae907e80 EFLAGS: 00010006 RAX: ffff8880935cc3c0 RBX: ffff88809838f810 RCX: ffffffff81329baa RDX: 0000000000010000 RSI: ffffffff810a1309 RDI: 0000000000000007 RBP: ffff8880ae907e80 R08: ffff8880935cc3c0 R09: ffffed1015d25be9 R10: ffffed1015d25be8 R11: ffff8880ae92df47 R12: 1ffff11015d20fd3 R13: ffff888094f64000 R14: ffff8880ae907ef8 R15: 0000000000000001 FS: 0000000002584940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8880ae907eb8 CR3: 00000000a86c1000 CR4: 00000000001426e0 Call Trace: vmcs_clear arch/x86/kvm/vmx/ops.h:185 [inline] loaded_vmcs_init+0x95/0x250 arch/x86/kvm/vmx/vmx.c:566 __loaded_vmcs_clear+0x229/0x360 arch/x86/kvm/vmx/vmx.c:633 flush_smp_call_function_queue+0x14a/0x500 kernel/smp.c:243 generic_smp_call_function_single_interrupt+0x13/0x2b kernel/smp.c:192 smp_call_function_single_interrupt+0xa3/0x460 arch/x86/kernel/smp.c:296 call_function_single_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:766 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x95/0xe0 kernel/locking/spinlock.c:184 Code: 48 c7 c0 f0 82 92 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d 32 2e 8f 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 5c 5e 4a fa 65 8b 05 f5 98 fe 78 RSP: 0018:ffff8880934df9d0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff04 RAX: 1ffffffff112505e RBX: 0000000000000286 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000286 RBP: ffff8880934df9e0 R08: ffff8880935cc3c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888080986bc0 R13: ffff888080986400 R14: ffff8880ae82d000 R15: ffff8880ae82d018 try_to_wake_up+0xc6/0xff0 kernel/sched/core.c:2074 wake_up_process kernel/sched/core.c:2142 [inline] wake_up_q+0x99/0x100 kernel/sched/core.c:453 futex_wake+0x429/0x4d0 kernel/futex.c:1624 do_futex+0x34c/0x1d50 kernel/futex.c:3609 __do_sys_futex kernel/futex.c:3665 [inline] __se_sys_futex kernel/futex.c:3633 [inline] __x64_sys_futex+0x3f7/0x590 kernel/futex.c:3633 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x449b09 Code: e8 cc b2 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b ff fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffe337b0278 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000449b09 RDX: 0000000000449b09 RSI: 0000000000000081 RDI: 00000000006dfc48 RBP: 00000000006dfc4c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dfc60 R13: 0000000000000000 R14: 000000000000002d R15: 20c49ba5e353f7cf Modules linked in: ---[ end trace 285e1020b1602a2c ]--- RIP: 0010:kvm_spurious_fault+0x9/0x10 arch/x86/kvm/x86.c:357 Code: e8 9c ce 65 00 41 bd 03 00 00 00 5b 44 89 e8 41 5c 41 5d 5d c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e8 77 ce 65 00 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 41 55 41 54 RSP: 0018:ffff8880ae907e80 EFLAGS: 00010006 RAX: ffff8880935cc3c0 RBX: ffff88809838f810 RCX: ffffffff81329baa RDX: 0000000000010000 RSI: ffffffff810a1309 RDI: 0000000000000007 RBP: ffff8880ae907e80 R08: ffff8880935cc3c0 R09: ffffed1015d25be9 R10: ffffed1015d25be8 R11: ffff8880ae92df47 R12: 1ffff11015d20fd3 R13: ffff888094f64000 R14: ffff8880ae907ef8 R15: 0000000000000001 FS: 0000000002584940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8880ae907eb8 CR3: 00000000a86c1000 CR4: 00000000001426e0