audit: type=1326 audit(1546308493.095:10097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=19315 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45ad2a code=0x50000 audit: type=1326 audit(1546308493.105:10098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=19315 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 ------------[ cut here ]------------ audit: type=1326 audit(1546308493.115:10099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=19315 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 kernel BUG at arch/x86/kvm/x86.c:357! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 19329 Comm: syz-executor2 Not tainted 4.20.0+ #2 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 audit: type=1326 audit(1546308493.115:10100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=19315 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 RIP: 0010:kvm_spurious_fault+0x9/0x10 arch/x86/kvm/x86.c:357 Code: e8 3c a6 75 00 41 bd 03 00 00 00 5b 44 89 e8 41 5c 41 5d 5d c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e8 17 a6 75 00 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 41 55 41 54 RSP: 0018:ffff88805e38f550 EFLAGS: 00010012 RAX: 0000000000040000 RBX: ffff88808aeff810 RCX: ffffc900118cb000 RDX: 000000000000847d RSI: ffffffff810bdb99 RDI: 0000000000000007 kobject: 'loop5' (00000000f205cff2): fill_kobj_path: path = '/devices/virtual/block/loop5' RBP: ffff88805e38f550 R08: ffff888051c86180 R09: fffff5200033b648 R10: fffff5200033b647 R11: ffffc900019db23b R12: 1ffff1100bc71eaf R13: ffff88805e38f598 R14: ffff88805e38f5f8 R15: ffff8880a4d35000 FS: 00007fbfb286e700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88805e38f598 CR3: 00000000a3131000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vmcs_clear arch/x86/kvm/vmx/ops.h:185 [inline] loaded_vmcs_init+0xcb/0x320 arch/x86/kvm/vmx/vmx.c:565 __loaded_vmcs_clear+0x2c1/0x520 arch/x86/kvm/vmx/vmx.c:632 generic_exec_single+0x383/0x610 kernel/smp.c:153 smp_call_function_single+0x1a9/0x660 kernel/smp.c:299 loaded_vmcs_clear arch/x86/kvm/vmx/vmx.c:641 [inline] free_loaded_vmcs+0x13c/0x1b0 arch/x86/kvm/vmx/vmx.c:2427 vmx_free_vcpu+0x1be/0x340 arch/x86/kvm/vmx/vmx.c:6673 kvm_arch_vcpu_free arch/x86/kvm/x86.c:8698 [inline] kvm_free_vcpus arch/x86/kvm/x86.c:9150 [inline] kvm_arch_destroy_vm+0x339/0x770 arch/x86/kvm/x86.c:9247 kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:748 [inline] kvm_put_kvm+0x6b2/0xff0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:769 kvm_vcpu_release+0x7b/0xa0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2491 __fput+0x3c5/0xb10 fs/file_table.c:278 ____fput+0x16/0x20 fs/file_table.c:309 task_work_run+0x1f4/0x2b0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x32a/0x3b0 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x696/0x800 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457ec9 Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fbfb286dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000457ec9 RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbfb286e6d4 R13: 00000000004c0e36 R14: 00000000004d2758 R15: 00000000ffffffff Modules linked in: ---[ end trace 2a83218fdfb4857b ]--- RIP: 0010:kvm_spurious_fault+0x9/0x10 arch/x86/kvm/x86.c:357 Code: e8 3c a6 75 00 41 bd 03 00 00 00 5b 44 89 e8 41 5c 41 5d 5d c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 e8 17 a6 75 00 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 d6 41 55 41 54 RSP: 0018:ffff88805e38f550 EFLAGS: 00010012 RAX: 0000000000040000 RBX: ffff88808aeff810 RCX: ffffc900118cb000 RDX: 000000000000847d RSI: ffffffff810bdb99 RDI: 0000000000000007 RBP: ffff88805e38f550 R08: ffff888051c86180 R09: fffff5200033b648 R10: fffff5200033b647 R11: ffffc900019db23b R12: 1ffff1100bc71eaf R13: ffff88805e38f598 R14: ffff88805e38f5f8 R15: ffff8880a4d35000 FS: 00007fbfb286e700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88805e38f598 CR3: 00000000a3131000 CR4: 00000000001426f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400