2022-01-04 09:28:36

by Nikunj A. Dadhania

Subject: [PATCH] KVM: x86: Do not create mmu_rmaps_stat for TDP MMU

With TDP MMU being the default now, access to mmu_rmaps_stat debugfs
file causes following oops:

BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 7 PID: 3185 Comm: cat Not tainted 5.16.0-rc4+ #204
RIP: 0010:pte_list_count+0x6/0x40
Call Trace:
<TASK>
? kvm_mmu_rmaps_stat_show+0x15e/0x320
seq_read_iter+0x126/0x4b0
? aa_file_perm+0x124/0x490
seq_read+0xf5/0x140
full_proxy_read+0x5c/0x80
vfs_read+0x9f/0x1a0
ksys_read+0x67/0xe0
__x64_sys_read+0x19/0x20
do_syscall_64+0x3b/0xc0
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fca6fc13912

Create mmu_rmaps_stat debugfs file only when rmaps are created.

Reported-by: Vasant Hegde <[email protected]>
Tested-by: Vasant Hegde <[email protected]>
Signed-off-by: Nikunj A Dadhania <[email protected]>
---
arch/x86/kvm/debugfs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/debugfs.c b/arch/x86/kvm/debugfs.c
index 543a8c04025c..78bb09a3a7b7 100644
--- a/arch/x86/kvm/debugfs.c
+++ b/arch/x86/kvm/debugfs.c
@@ -180,7 +180,8 @@ static const struct file_operations mmu_rmaps_stat_fops = {

int kvm_arch_create_vm_debugfs(struct kvm *kvm)
{
- debugfs_create_file("mmu_rmaps_stat", 0644, kvm->debugfs_dentry, kvm,
- &mmu_rmaps_stat_fops);
+ if (kvm_memslots_have_rmaps(kvm))
+ debugfs_create_file("mmu_rmaps_stat", 0644, kvm->debugfs_dentry, kvm,
+ &mmu_rmaps_stat_fops);
return 0;
}
--
2.32.0

2022-01-04 09:49:43

by Peter Xu

Subject: Re: [PATCH] KVM: x86: Do not create mmu_rmaps_stat for TDP MMU

Hi, Nikunj,

On Tue, Jan 04, 2022 at 02:58:14PM +0530, Nikunj A Dadhania wrote:
> With TDP MMU being the default now, access to mmu_rmaps_stat debugfs
> file causes following oops:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> PGD 0 P4D 0
> Oops: 0000 [#1] PREEMPT SMP NOPTI
> CPU: 7 PID: 3185 Comm: cat Not tainted 5.16.0-rc4+ #204
> RIP: 0010:pte_list_count+0x6/0x40
> Call Trace:
> <TASK>
> ? kvm_mmu_rmaps_stat_show+0x15e/0x320
> seq_read_iter+0x126/0x4b0
> ? aa_file_perm+0x124/0x490
> seq_read+0xf5/0x140
> full_proxy_read+0x5c/0x80
> vfs_read+0x9f/0x1a0
> ksys_read+0x67/0xe0
> __x64_sys_read+0x19/0x20
> do_syscall_64+0x3b/0xc0
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7fca6fc13912
>
> Create mmu_rmaps_stat debugfs file only when rmaps are created.
>
> Reported-by: Vasant Hegde <[email protected]>
> Tested-by: Vasant Hegde <[email protected]>
> Signed-off-by: Nikunj A Dadhania <[email protected]>

Shall we put the check into kvm_mmu_rmaps_stat_show()? As iiuc the rmap can be
allocated dynamically (shadow_root_allocated changing from 0->1).

Thanks,

--
Peter Xu

2022-01-04 10:38:31

by Nikunj A. Dadhania

Subject: Re: [PATCH] KVM: x86: Do not create mmu_rmaps_stat for TDP MMU

Hi Peter,

On 1/4/2022 3:19 PM, Peter Xu wrote:
> Hi, Nikunj,
>
> On Tue, Jan 04, 2022 at 02:58:14PM +0530, Nikunj A Dadhania wrote:
>> With TDP MMU being the default now, access to mmu_rmaps_stat debugfs
>> file causes following oops:
>>
>> BUG: kernel NULL pointer dereference, address: 0000000000000000
>> PGD 0 P4D 0
>> Oops: 0000 [#1] PREEMPT SMP NOPTI
>> CPU: 7 PID: 3185 Comm: cat Not tainted 5.16.0-rc4+ #204
>> RIP: 0010:pte_list_count+0x6/0x40
>> Call Trace:
>> <TASK>
>> ? kvm_mmu_rmaps_stat_show+0x15e/0x320
>> seq_read_iter+0x126/0x4b0
>> ? aa_file_perm+0x124/0x490
>> seq_read+0xf5/0x140
>> full_proxy_read+0x5c/0x80
>> vfs_read+0x9f/0x1a0
>> ksys_read+0x67/0xe0
>> __x64_sys_read+0x19/0x20
>> do_syscall_64+0x3b/0xc0
>> entry_SYSCALL_64_after_hwframe+0x44/0xae
>> RIP: 0033:0x7fca6fc13912
>>
>> Create mmu_rmaps_stat debugfs file only when rmaps are created.
>>
>> Reported-by: Vasant Hegde <[email protected]>
>> Tested-by: Vasant Hegde <[email protected]>
>> Signed-off-by: Nikunj A Dadhania <[email protected]>
>
> Shall we put the check into kvm_mmu_rmaps_stat_show()? As iiuc the rmap can be
> allocated dynamically (shadow_root_allocated changing from 0->1).

Yes, that will cover the above case. And mmu_rmaps_stat file will be empty
in case when rmaps are not allocated.

Regards
Nikunj