MIME-Version: 1.0
In-Reply-To: <CANRm+Cy_=ZO9eJGk2HzgN0by_c_uoEPFNa850+GvsYvJAw0DwA@mail.gmail.com>
References: <001a1145e8548cbd3d055f73374f@google.com> <alpine.DEB.2.20.1712141807400.4998@nanos>
 <CA+55aFzLw629nbk0GL=9=x3sjkxkKjiVW=mL6Pjm7i2vTLwyVw@mail.gmail.com>
 <CALCETrVRq9OKYu+rbvKeuY+pD14X8etW3hzVxJqznzH9T_PvMg@mail.gmail.com>
 <CA+55aFw7JJjdmG0R9Vwz8NLOS9npDfyLd8zJ=TP68JufUoph1A@mail.gmail.com>
 <CALCETrWgfgewYk1tkBE6cLqF-mVhRNOJm9_Z45_shsiiNJc1Fw@mail.gmail.com>
 <CA+55aFxxJ3aGmu+ELGZf_+OpDM1vcu4d9=nEaodrKPGPtNV-5w@mail.gmail.com>
 <CACT4Y+YBMFq0JdwF2K7xfGC7sPxdJOzj9V2TPEKGuJgqaknu9A@mail.gmail.com>
 <CACT4Y+bMCBv_eEm7gPAh4M-oVsgf1c-TxDoH-TbBBty5_xkiWA@mail.gmail.com>
 <CACT4Y+buFtqoO6KF0ZW1HQTMC3rVZ=_0FQq826TmWLZyxkPcwA@mail.gmail.com>
 <1036ed60-035c-70a0-0a5f-00efe8ebf4da@redhat.com> <CANRm+Cy_=ZO9eJGk2HzgN0by_c_uoEPFNa850+GvsYvJAw0DwA@mail.gmail.com>
From: Dmitry Vyukov <dvyukov@google.com>
Date: Fri, 15 Dec 2017 11:02:38 +0100
Message-ID: <CACT4Y+Zrv2=ZdjsKWUZzM16dHxRDfFJEi3j8TYYBCDjSJzSSkw@mail.gmail.com>
Subject: Re: BUG: unable to handle kernel paging request in __switch_to
To: Wanpeng Li <kernellwp@gmail.com>
Cc: David Hildenbrand <david@redhat.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Andy Lutomirski <luto@kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        syzbot 
        <bot+1f445b1009b8eeededa30fe62ccf685f2ec9d155@syzkaller.appspotmail.com>,
        Borislav Petkov <bp@suse.de>, Dmitry Safonov <dsafonov@virtuozzo.com>,
        Peter Anvin <hpa@zytor.com>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Kyle Huey <me@kylehuey.com>, Ingo Molnar <mingo@redhat.com>,
        syzkaller-bugs@googlegroups.com,
        "the arch/x86 maintainers" <x86@kernel.org>,
        Paolo Bonzini <pbonzini@redhat.com>,
        =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= <rkrcmar@redhat.com>,
        KVM list <kvm@vger.kernel.org>, "Lan, Tianyu" <tianyu.lan@intel.com>,
        James Mattson <jmattson@google.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1744
Lines: 47

On Fri, Dec 15, 2017 at 10:58 AM, Wanpeng Li <kernellwp@gmail.com> wrote:
> 2017-12-15 17:51 GMT+08:00 David Hildenbrand <david@redhat.com>:
>>
>>> int main()
>>> {
>>>   int fd = open("/dev/kvm", 0x80102ul);
>>>   int vm = ioctl(fd, KVM_CREATE_VM, 0);
>>>   int  cpu = ioctl(vm, KVM_CREATE_VCPU, 4);
>>
>> Not even a memory region :) So maybe the first memory access directly
>> triggers a fault?
>>
>>>   ioctl(cpu, KVM_RUN, 0);
>>>   return 0;
>>> }
>>>
>>> And, yes, this in fact triggers instant reboot of kernel (running in qemu).
>>> Am I missing something here?
>>>
>>> +kvm maintainers, you can see full thread here:
>>> https://groups.google.com/forum/#!topic/syzkaller-bugs/_oveOKGm3jw
>
> I didn't see any issue after running the test.

Yes, it's strange. But I can reproduce it. There must be something
different in our setups.
Here is how to build exact same kernel:
https://groups.google.com/d/msg/syzkaller-bugs/_oveOKGm3jw/vc1tXvsbCgAJ

Here is how I start qemu:

qemu-system-x86_64 -hda wheezy.img -net
user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net nic -nographic -kernel
arch/x86/boot/bzImage -append "kvm-intel.nested=1
kvm-intel.unrestricted_guest=1 kvm-intel.ept=1
kvm-intel.flexpriority=1 kvm-intel.vpid=1
kvm-intel.emulate_invalid_guest_state=1 kvm-intel.eptad=1
kvm-intel.enable_shadow_vmcs=1 kvm-intel.pml=1
kvm-intel.enable_apicv=1 console=ttyS0 root=/dev/sda
earlyprintk=serial slub_debug=UZ vsyscall=native rodata=n oops=panic
panic_on_warn=1 panic=86400" -enable-kvm -pidfile vm_pid -m 2G -smp 4
-cpu host -usb -usbdevice mouse -usbdevice tablet -soundhw all

The image is here:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#crash-does-not-reproduce

Host cpu is Intel(R) Xeon(R) CPU E5-2690 v3