Re: kvm: BUG in pte_list_remove

From: Wanpeng Li
Date: Mon Mar 27 2017 - 03:06:46 EST

2017-03-24 0:42 GMT+08:00 Dmitry Vyukov <dvyukov@xxxxxxxxxx>:
> On Mon, Nov 14, 2016 at 10:43 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>> On Mon, Nov 14, 2016 at 10:34 AM, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote:
>>>
>>>
>>> On 14/11/2016 10:03, Dmitry Vyukov wrote:
>>>> Paolo,
>>>> can you please also commit this test to tools/testing? We are
>>>> frustrated by the situation that we reported hundreds of bugs with
>>>> reproducers, but exactly 0 kernel regression tests were added.
>>>
>>> Ok. Last time I only put the reproducers in commit messages. We can
>>> look into adding some KVM regression testing to tools/testing this time.
>>
>>
>> Tests in commit messages will be lost.
>> Growing a base of kernel regression tests will be great.
>>
>>
>>>> On Sun, Nov 13, 2016 at 5:00 PM, Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote:
>>>>> Beautified source code:
>>>>>
>>>>> #include <fcntl.h>
>>>>> #include <pthread.h>
>>>>> #include <setjmp.h>
>>>>> #include <signal.h>
>>>>> #include <stddef.h>
>>>>> #include <stdint.h>
>>>>> #include <stdio.h>
>>>>> #include <stdlib.h>
>>>>> #include <string.h>
>>>>> #include <sys/ioctl.h>
>>>>> #include <sys/stat.h>
>>>>> #include <sys/syscall.h>
>>>>> #include <sys/types.h>
>>>>> #include <unistd.h>
>>>>> #include <linux/kvm.h>
>>>>>
>>>>> long r[16];
>>>>>
>>>>> int main()
>>>>> {
>>>>> void *p = valloc(0x4000);
>>>>>
>>>>> r[2] = open("/dev/kvm", 0);
>>>>> r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
>>>>>
>>>>> uint64_t addr = 0xf000;
>>>>> ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
>>>>> r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
>>>>> ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
>>>>> ioctl(r[6], KVM_RUN, 0);
>>>>> ioctl(r[6], KVM_RUN, 0);
>>>>>
>>>>> struct kvm_userspace_memory_region mr = {
>>>>> .slot = 0,
>>>>> .flags = KVM_MEM_LOG_DIRTY_PAGES,
>>>>> .guest_phys_addr = 0xf000,
>>>>> .memory_size = 0x4000,
>>>>> .userspace_addr = (uintptr_t) p
>>>>> };
>>>>> ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
>>>>> return 0;
>>>>> }
>
>
> This is still happens on a recent 093b995e3b55a0ae0670226ddfcb05bfbf0099ae:
>
>
> ------------[ cut here ]------------
> kernel BUG at arch/x86/kvm/mmu.c:1157!
> invalid opcode: 0000 [#1] SMP KASAN
> Modules linked in:
> CPU: 0 PID: 2966 Comm: a.out Not tainted 4.11.0-rc3+ #365
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> task: ffff88006432a5c0 task.stack: ffff880064e48000
> RIP: 0010:pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156
> RSP: 0018:ffff880064e4eda0 EFLAGS: 00010282
> RAX: 0000000000000028 RBX: ffff88006ac72180 RCX: 0000000000000000
> RDX: 0000000000000028 RSI: 1ffff1000c9c9d72 RDI: ffffed000c9c9da8
> RBP: ffff880064e4ede0 R08: ffffed000da03dae R09: ffffed000da03dae
> R10: 0000000000000001 R11: ffffed000da03dad R12: 000000000000000f
> R13: 0000000000000000 R14: ffff88006bcd8ec0 R15: ffff88006bcd8ee8
> FS: 0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000000 CR3: 000000006870b000 CR4: 00000000001426f0
> Call Trace:
> rmap_remove arch/x86/kvm/mmu.c:1233 [inline]
> drop_spte+0x16c/0x270 arch/x86/kvm/mmu.c:1315
> mmu_page_zap_pte+0x223/0x350 arch/x86/kvm/mmu.c:2427
> kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2449 [inline]
> kvm_mmu_prepare_zap_page+0x1bb/0x1260 arch/x86/kvm/mmu.c:2493
> kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:5123 [inline]
> kvm_mmu_invalidate_zap_all_pages+0x4a8/0x680 arch/x86/kvm/mmu.c:5164
> kvm_arch_flush_shadow_all+0x15/0x20 arch/x86/kvm/x86.c:8370
> kvm_mmu_notifier_release+0x71/0xb0
> arch/x86/kvm/../../../virt/kvm/kvm_main.c:472
> __mmu_notifier_release+0x1e5/0x6b0 mm/mmu_notifier.c:75
> mmu_notifier_release include/linux/mmu_notifier.h:235 [inline]
> exit_mmap+0x3a3/0x470 mm/mmap.c:2941
> __mmput kernel/fork.c:894 [inline]
> mmput+0x25e/0x790 kernel/fork.c:916
> exit_mm kernel/exit.c:558 [inline]
> do_exit+0xa51/0x26d0 kernel/exit.c:866
> do_group_exit+0x149/0x400 kernel/exit.c:983
> SYSC_exit_group kernel/exit.c:994 [inline]
> SyS_exit_group+0x1d/0x20 kernel/exit.c:992
> entry_SYSCALL_64_fastpath+0x1f/0xc2
> RIP: 0033:0x433609
> RSP: 002b:00007ffdbe967178 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000433609
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7
> R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000d7fbb0
> R13: 000000000001b411 R14: 0000000000002710 R15: 00000000006c08b8
> Code: 99 f9 5d 00 48 8b 75 d0 48 c7 c7 00 4a 42 84 e8 9c 13 72 00 0f
> 0b e8 82 f9 5d 00 48 8b 75 d0 48 c7 c7 c0 49 42 84 e8 85 13 72 00 <0f>
> 0b 4c 89 ef e8 78 14 8c 00 e9 01 fe ff ff 0f 1f 00 55 48 89
> RIP: pte_list_remove+0x3ae/0x3c0 arch/x86/kvm/mmu.c:1156 RSP: ffff880064e4eda0
> ---[ end trace 2cf22c8ade550ee0 ]---
>
>
> #include <fcntl.h>
> #include <pthread.h>
> #include <setjmp.h>
> #include <signal.h>
> #include <stddef.h>
> #include <stdint.h>
> #include <stdio.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/ioctl.h>
> #include <sys/stat.h>
> #include <sys/syscall.h>
> #include <sys/types.h>
> #include <unistd.h>
> #include <linux/kvm.h>
>
> long r[16];
>
> int main()
> {
> void *p = valloc(0x4000);
>
> r[2] = open("/dev/kvm", 0);
> r[3] = ioctl(r[2], KVM_CREATE_VM, 0x0ul);
>
> uint64_t addr = 0xf000;
> ioctl(r[3], KVM_SET_IDENTITY_MAP_ADDR, &addr);
> r[6] = ioctl(r[3], KVM_CREATE_VCPU, 0x0ul);
> ioctl(r[3], KVM_SET_TSS_ADDR, 0x0ul);
> ioctl(r[6], KVM_RUN, 0);
> ioctl(r[6], KVM_RUN, 0);
>
> struct kvm_userspace_memory_region mr = {
> .slot = 0,
> .flags = KVM_MEM_LOG_DIRTY_PAGES,
> .guest_phys_addr = 0xf000,
> .memory_size = 0x4000,
> .userspace_addr = (uintptr_t) p
> };
> ioctl(r[3], KVM_SET_USER_MEMORY_REGION, &mr);
> return 0;
> }

Please refer to https://www.spinics.net/lists/kernel/msg2474480.html.

Regards,
Wanpeng Li