Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <e4589879-1139-22cc-854f-fed22cc18693@oracle.com>
Date:   Tue, 30 May 2023 11:09:09 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.10.1
Subject: Re: [syzbot] [kvm?] [net?] [virt?] general protection fault in
 vhost_work_queue
Content-Language: en-US
To:     Stefano Garzarella <sgarzare@redhat.com>,
        "Michael S. Tsirkin" <mst@redhat.com>
Cc:     syzbot <syzbot+d0d442c22fa8db45ff0e@syzkaller.appspotmail.com>,
        jasowang@redhat.com, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com,
        virtualization@lists.linux-foundation.org, stefanha@redhat.com
References: <0000000000001777f605fce42c5f@google.com>
 <20230530072310-mutt-send-email-mst@kernel.org>
 <CAGxU2F7O7ef3mdvNXtiC0VtWiS2DMnoiGwSR=Z6SWbzqcrBF-g@mail.gmail.com>
 <CAGxU2F7HK5KRggiY7xnKHeXFRXJmqcKbjf3JnXC3mbmn9xqRtw@mail.gmail.com>
From:   Mike Christie <michael.christie@oracle.com>
In-Reply-To: <CAGxU2F7HK5KRggiY7xnKHeXFRXJmqcKbjf3JnXC3mbmn9xqRtw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?V2E3cGtKMGhuVXJyc3FkeE1PWTNqa0x4UDFTdllmQzBKU2ZzM2ZsSFJWZHNa?=
 =?utf-8?B?UlI1eGpGN3hHSWNQZTducnl2aTVqRHJaQzhtUlVGU0QydGlseEh2OFc1THUr?=
 =?utf-8?B?K0lyN1R0NVFtaFFqODdxQkh3TE9EZnVXNVR1TDFXakxxZnN4c09PSi9VTXZI?=
 =?utf-8?B?ZXpTWThsMFhPRjBzeE9JNitCaUFySXJnMTkzN3NROGZvZ1RkWVBidWxhUFBl?=
 =?utf-8?B?Qndja3ZMcG9kK1hlVk5CV0FxQkxCSkd0M1NEMUxFTmJZQnZJWk5HNXNVYlVZ?=
 =?utf-8?B?OXI3RGE4Z200anJqb2Q5SFZXa2diUm90N3BSNVBZaXF3QmFzbmNKRUo1SVV3?=
 =?utf-8?B?eU5UOEhkSHVKVzBSSEY2K0l3b1ZJRStkWFR2QkRXeSswaDY2QjI3NFgzSHI1?=
 =?utf-8?B?b2NCMktoYlRwczE4d2sySFMzR3ZjbXBsbFBncmsxdzlYNnlSYkRaUURrSW5I?=
 =?utf-8?B?Q2dxdlpnZ3VwQXpFM3luQzBqSmYzWVhHaVk2ZWNzVjNZVmwyR2VJYVoxa2FQ?=
 =?utf-8?B?Z2ZXRmdObmVIVzEwTmdaVTFNc2VNYWNUTTlqOGtxRzBHN3JyT0YyMkkwRTQ1?=
 =?utf-8?B?RDNMbEZJYlVPaHdpbWgyY2dZcllaTThwQjFIdEpLVEdKaFE1aVFvMlhiYndE?=
 =?utf-8?B?RG0wdnYvTWM1UE9ZSUpwazB5eW1XeDlZVkYwRzhQbGJtVVVQMktJY3pxV0lx?=
 =?utf-8?B?V2ZqQjJUVzB3c0crd0RZNkk3ZkY0SUFBWUpnTnQ4djU2NEF1N3JGNzJRRFda?=
 =?utf-8?B?a3FZQXRVN09iQ21OVWdpd2I2eUVNSkp4RXRiRXBMSVkyYXJwYWZZUU9QMXRn?=
 =?utf-8?B?SmNEQlFvb0VlSEVvckhobVlpR3JtenNZYUNhUVU0ei9JV2FlQ1B0SDhyQUhn?=
 =?utf-8?B?UGdGWC9lbWk0cGpMcTRRZWRGM2tkT0dOOE5pQnBvK3JTV0lPMnIreExlWGUx?=
 =?utf-8?B?L21rd1BBWnhmdU10K2JGa1MxMCtNY0dRbjdJRVFIaFBWUlYwbXYzeFhsRW1y?=
 =?utf-8?B?L3gzVlhrd3VuTEJremlwYytSUkNHcUVmcVV6V3VNN3RyQU1VSlVGVEV1K2RH?=
 =?utf-8?B?c1Z4OHZjS054bG12QUdsNGJ3dmhKTys1cjgvWjFQRU1xQ2xyemhuY2VOUFlp?=
 =?utf-8?B?NUY3NEFHZ0U5Z3hvc085QnJtbTUvbWV3bFpGOHIwZ1dKNmxWemRtRUc5Sk12?=
 =?utf-8?B?d0RhTXN5bHZCbmhGN1FaeFVsUHRoNWllOStwMWNVbUNHczVHeGdwSlhsZ3Y1?=
 =?utf-8?B?aUVlN0pNc1MwV0FkbkdsYWFsVWtyb09DYVlNTUZSWkFyOFp2WWVvdEwrQXM5?=
 =?utf-8?B?cW1OTXhFLzFVVWVvUUE1RC9jVWs3aElyNlBsK2ZDNW1ScFJpYlFEL1dJSVk3?=
 =?utf-8?B?YmpMR1drNGRxTjZ1NEhIM2FDaWRmQndUbCtSUFlpZmQ5SEtnbklvejVQSWQz?=
 =?utf-8?B?K2xxcXRWQ0NrSy85cGhYUlFOSWpodXVvYXdYVHhrNHJydmwvMGJNYjNqY3oz?=
 =?utf-8?B?ZVNKNDVoOFc2OTZKcjdrUHRjUkY4MjJzVFJIeXZhbWNXeE1nUmpUUUhTenlq?=
 =?utf-8?B?VDJ3MENoNXNla0V5THJHeWU1ZmNqdnJEaURlSmZzSldKQWV3SERBWWJVdjg5?=
 =?utf-8?B?dVcxTnVmazNSaFBLeTVMSFN4STNIRWVjZ3ZEb2VqWGtCdjI4YUs5VGcvRkwr?=
 =?utf-8?B?dGdXY1NyeUZkV0VmK3FzTEIzSFQyY0xzQ2pHR1ZUVmVCWXpmVStpbWEzQnN0?=
 =?utf-8?B?VEZlS2k1MkkvUFQ5MGZQUzZ1WU1lMDFET1lDblU3a3BwSkVFb0wyWVhLb09M?=
 =?utf-8?B?R2dwSlhrbVRUV3g2Rno3TVlkb09CZFQrU0wzdmE5dUtienZwTVpUTHJCdUsw?=
 =?utf-8?B?cURTOHNmamtLeHNhNnkwMWtxcW5wdTR3cVk4T2xDbEllc1hLZ1gwdmZJUElM?=
 =?utf-8?B?TDVFMDRiWlJXSjlsWnBObDZMVUZJK21EUTZSVFQ3aHZWcXlNWGU3dWhKakti?=
 =?utf-8?B?VTJYUitPUUtYcGtMNnowYktyUHg4ZVdqWVdMcEkvK3RNeWFHZXFMR3RIT3Rx?=
 =?utf-8?B?NUhUVjJubnFtZXFOcEd6czA3NXcwWUJ5Rm95MlRCTzVtYUdjUzhoM3FLL253?=
 =?utf-8?B?eUxZREJ3Y1JRaitEc2hZK1RzNnJ1Nk1KbGxkZkhLaG5LcHN6WDlMYzNvejJP?=
 =?utf-8?B?TlE9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?utf-8?B?ci9MelRNSjU2U3pONEtUQUZncUJsNWNZa3YvUDZXV0I1Y1FJeE95RkpiWTlv?=
 =?utf-8?B?OGg5eGJCckVRZGt6Y3V3eXFBdzBpRSs3b200VjJoNGZ6eWJyWmdBVzlRRTdY?=
 =?utf-8?B?T0VBY2hab1pYdDNmN0U5ck9FQ2FmMkdMcDQ2MlpqWG5ob2Z1dmMxaFJtRkJB?=
 =?utf-8?B?TXF1WnRmTlpsOC83Z3VhazVJU3dYQVZlemYybGE0aEtQdkRZc2dpZ1cySVJj?=
 =?utf-8?B?cUlobDYwZTdWTXFpSGN2S1VLT2Z3QTJZR2czWkRwVGpTV2NsdzkrL0Z5dlRF?=
 =?utf-8?B?YVJ5Ym5Eb09sa0dUaU95OEVLS3Y0TWYrWitHQWNVZmxUOXE2enQ3dnlNOVBC?=
 =?utf-8?B?VFNPRXJkT0RLSXpsTlBXRzVTN2xvNDc2eHRCWE9mWmpBM25BNjNobnN3WXUw?=
 =?utf-8?B?KzZETnBkNjBRSk9weldnWlFqS3Rjci9iOHhDbjliYkhVZVhXaGtnMVh5by8r?=
 =?utf-8?B?Z0ozcjY1OTl1STFIWVdXVXVHemo0ZSt4eWVReFlnMGhjQ1dTZEREcU9SNkk4?=
 =?utf-8?B?R2dTYmdCQnFKOGI0YjZQQ1F6L05KU1ZEQ0hIcHcxaExTaDVRZHJiVnlhdkRF?=
 =?utf-8?B?WnhHUkc2ckV5NGhKUXRFVmRzTU13WC9FZ2VsV2xIOEtjeHFKRW1CQXBOTXNG?=
 =?utf-8?B?RWF3YU56OTgzR09IWEtiWTRDN3ViNTlEQWlvQkFrT0xBSTNvZkFqREdScFdu?=
 =?utf-8?B?UkF6MWpSZUF3MTlTbVJ0NXFJMnh6Y25zdGNCVm9WcHBHM1FsZ1FCa2k5Kzdm?=
 =?utf-8?B?RzQ0bWtuRnIwOHA2VXNCOVRrZDlaNHh5VUppVWpkb3FCUlVBVXRqTEwrVTZO?=
 =?utf-8?B?bUtpKzI0alBTd3hTMlZkNUVtR21nOUs5aEpxUGRrWmhrNXMxZjVWTDdrcmNk?=
 =?utf-8?B?TkJLR05kcExoaUdLTTBiTzhscWpEMnRDSzJmQXNSZWlBUllxV0NVdUlGaXBK?=
 =?utf-8?B?eFVUby93TS85SmxVWmluQWZkdnhaTlBjdXFjeHBueUN2dEpEQ2ZGQlRZNmZs?=
 =?utf-8?B?RDdhOEhJZCs5cldzemR5eFFHMmpkVHBBMDRxZnZMb0NWTW5VeFF1WnFGVkZG?=
 =?utf-8?B?VTFmUXVraDBCT0lnblM4MnZFL05uRFhzR2FST0Z3LzFOL0t1dDl6L2ZIVXdj?=
 =?utf-8?B?UVFzVndvS1hNRENRN3BwWWFUUUtZT1I4b2JSTVAwam92OXZHQkx1ckYrdGYr?=
 =?utf-8?B?MEIvWjdZZmRUb2hkeUpPSkpDK3VzdS9IaVdYTEhvVFh5ck02V1BxYjM1Z0Jn?=
 =?utf-8?B?Wk52SEdGc3FDaks4dUJjTHhxZ0MvLzA5SHRXdnV1c21zTitwemFuK3U1ZWlE?=
 =?utf-8?Q?pnbryLkrHDO0k=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c6a478e2-3313-4f26-db87-08db6128350c
X-MS-Exchange-CrossTenant-AuthSource: CY8PR10MB7243.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 May 2023 16:09:12.0952
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: T83EcU00rN+1jqRcmiNunmiG3c6WXxsLQiyzVTUztli09a6/9Ny/cQ4j7iRdWu5uhzGbpDzIlDL+hTDlgV/V+d4rzeHm5X0j49xNser5bGA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR10MB5709
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.573,FMLib:17.11.176.26
 definitions=2023-05-30_12,2023-05-30_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxlogscore=999
 adultscore=0 malwarescore=0 bulkscore=0 suspectscore=0 mlxscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2304280000 definitions=main-2305300128
X-Proofpoint-ORIG-GUID: etV_ONXphCRmSocuLiwEqjXcuwlPFteG
X-Proofpoint-GUID: etV_ONXphCRmSocuLiwEqjXcuwlPFteG
X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 5/30/23 11:00 AM, Stefano Garzarella wrote:
> I think it is partially related to commit 6e890c5d5021 ("vhost: use
> vhost_tasks for worker threads") and commit 1a5f8090c6de ("vhost: move
> worker thread fields to new struct"). Maybe that commits just
> highlighted the issue and it was already existing.

See my mail about the crash. Agree with your analysis about worker->vtsk
not being set yet. It's a bug from my commit where I should have not set
it so early or I should be checking for

if (dev->worker && worker->vtsk)

instead of 

if (dev->worker)

One question about the behavior before my commit though and what we want in
the end going forward. Before that patch we would just drop work if
vhost_work_queue was called before VHOST_SET_OWNER. Was that correct/expected?

The call to vhost_work_queue in vhost_vsock_start was only seeing the
works queued after VHOST_SET_OWNER. Did you want works queued before that?