[lkml]   [2018]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: kernel BUG at arch/x86/kvm/x86.c:LINE! (2)
On 11/10/2018 04:57, Du Changbin wrote:
> I think the issue is that using vmx instructions after vmx off. The
> scenario is:
> 1. kernel is rebooting and vmx is turned off by notification handler
> kvm_reboot(),
>    and 'kvm_rebooting' is set.
> 2. But there is a pending KVM_CREATE_VCPU ioctl which will invoke
> vmcs_clear()->
>    ____kvm_handle_fault_on_reboot()->kvm_spurious_fault()->BUG().
> Need to improve the handler for such case so won't hang kernel.

Why would the kernel be rebooting, given the reproducer (listed below my
signature, or at

I think this is a duplicate of

WARNING: refcount bug in kvm_vm_ioctl
BUG: unable to handle kernel paging request in

In all cases the refcounts seem to be broken, and kvm_destroy_kvm is
called prematurely (which in this case results in hardware_disable_all
being called, so that the vmclear fails).

Dmitry, have such bugs been reported for subsystems other than KVM?


#syz dup: WARNING: refcount bug in kvm_vm_ioctl

> # See for information about syzkaller reproducers.
> #{"threaded":true,"repeat":true,"procs":6,"sandbox":"","fault_call":-1,"tmpdir":true}
> r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
> r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
> r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
> ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)={0x5, 0x7, 0x40, 0x0, 0x0, 0x0, 0x0, 0x492, 0x5, 0x1, 0xffff, 0x0, 0x0, 0xef, 0x100000000, 0x0, 0x100})
> ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil})
> ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000003c0)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x8005001f, 0x0, 0x0, 0x28, 0x0, 0x6500})
> ioctl$KVM_RUN(r2, 0xae80, 0x0)

 \ /
  Last update: 2018-10-11 16:32    [W:0.089 / U:0.900 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site