From: Yikebaer Aizezi <yikebaer61@gmail.com>
To: Sean Christopherson <seanjc@google.com>
Cc: pbonzini@redhat.com, tglx@linutronix.de, mingo@redhat.com,
bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org,
hpa@zytor.com, jarkko@kernel.org, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-sgx@vger.kernel.org
Subject: Re: WARNING in kvm_arch_vcpu_ioctl_run
Date: Fri, 4 Aug 2023 10:35:00 +0800 [thread overview]
Message-ID: <CALcu4rZt5i5UD9vGBb-PdUwNN-OOSEa=ykd+bf2=44Okz1aO0g@mail.gmail.com> (raw)
In-Reply-To: <ZMwSKy09gsa/dL08@google.com>
Just patched it, after dropping the sanity check, I rerun the
reproduce program, and the crash was not triggered.
seems like the problem is fixed for now, Thanks
Sean Christopherson <seanjc@google.com> 于2023年8月4日周五 04:46写道：
>
> On Thu, Jul 27, 2023, Yikebaer Aizezi wrote:
> > Hello, I'm sorry for the mistake in my previous email. I forgot to add
> > a subject. This is my second attempt to send the message.
> >
> > When using Healer to fuzz the latest Linux kernel, the following crash
> > was triggered.
> >
> > HEAD commit: fdf0eaf11452d72945af31804e2a1048ee1b574c (tag: v6.5-rc2)
> >
> > git tree: upstream
> >
> > console output:
> > https://drive.google.com/file/d/1FiemC_AWRT-6EGscpQJZNzYhXZty6BVr/view?usp=drive_link
> > kernel config: https://drive.google.com/file/d/1fgPLKOw7QbKzhK6ya5KUyKyFhumQgunw/view?usp=drive_link
> > C reproducer: https://drive.google.com/file/d/1SiLpYTZ7Du39ubgf1k1BIPlu9ZvMjiWZ/view?usp=drive_link
> > Syzlang reproducer:
> > https://drive.google.com/file/d/1eWSmwvNGOlZNU-0-xsKhUgZ4WG2VLZL5/view?usp=drive_link
> > Similar report:
> > https://groups.google.com/g/syzkaller-bugs/c/C2ud-S1Thh0/m/z4iI7l_dAgAJ
> >
> > If you fix this issue, please add the following tag to the commit:
> > Reported-by: Yikebaer Aizezi <yikebaer61@gmail.com>
> >
> > kvm: vcpu 129: requested lapic timer restore with starting count
> > register 0x390=4241646265 (4241646265 ns) > initial count (296265111
> > ns). Using initial count to start timer.
> > ------------[ cut here ]------------
> > WARNING: CPU: 0 PID: 1977 at arch/x86/kvm/x86.c:11098
> > kvm_arch_vcpu_ioctl_run+0x152f/0x1830 arch/x86/kvm/x86.c:11098
>
> Well that's annoying. The WARN is a sanity check that KVM doesn't somehow put
> the guest into an uninitialized state while emulating the guest's APIC timer, but
> I completely overlooked the fact that userspace can simply stuff the should-be-
> impossible guest state. *sigh*
>
> Sadly, I think the most reasonable thing to do is to simply drop the sanity check :-(
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 0145d844283b..e9e262b244b8 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -11091,12 +11091,17 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu)
> r = -EINTR;
> goto out;
> }
> +
> /*
> - * It should be impossible for the hypervisor timer to be in
> - * use before KVM has ever run the vCPU.
> + * Don't bother switching APIC timer emulation from the
> + * hypervisor timer to the software timer, the only way for the
> + * APIC timer to be active is if userspace stuffed vCPU state,
> + * i.e. put the vCPU and into a nonsensical state. The only
> + * transition out of UNINITIALIZED (without more state stuffing
> + * from userspace) is an INIT, which will reset the local APIC
> + * and thus smother the timer anyways, i.e. APIC timer IRQs
> + * will be dropped no matter what.
> */
> - WARN_ON_ONCE(kvm_lapic_hv_timer_in_use(vcpu));
> -
> kvm_vcpu_srcu_read_unlock(vcpu);
> kvm_vcpu_block(vcpu);
> kvm_vcpu_srcu_read_lock(vcpu);
>
prev parent reply other threads:[~2023-08-04 2:35 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-27 8:03 WARNING in kvm_arch_vcpu_ioctl_run Yikebaer Aizezi
2023-08-03 20:46 ` Sean Christopherson
2023-08-04 2:35 ` Yikebaer Aizezi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CALcu4rZt5i5UD9vGBb-PdUwNN-OOSEa=ykd+bf2=44Okz1aO0g@mail.gmail.com' \
--to=yikebaer61@gmail.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=jarkko@kernel.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sgx@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).