Received-SPF: pass (google.com: domain of linux-kernel+bounces-109912-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: Paul Durrant <xadimgnik@gmail.com>
Message-ID: <ad0ad0d3-5be0-447d-8c0b-6b77e763dad9@xen.org>
Date: Thu, 21 Mar 2024 10:59:22 +0000
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Reply-To: paul@xen.org
Subject: Re: [syzbot] [kvm?] WARNING in __kvm_gpc_refresh
To: David Woodhouse <dwmw2@infradead.org>,
 syzbot <syzbot+106a4f72b0474e1d1b33@syzkaller.appspotmail.com>,
 kvm@vger.kernel.org, linux-kernel@vger.kernel.org, pbonzini@redhat.com,
 syzkaller-bugs@googlegroups.com
References: <0000000000005fa5cc0613f1cebd@google.com>
 <b7561e6d6d357fcd8ec1a1257aaf2f97d971061c.camel@infradead.org>
Content-Language: en-US
Organization: Xen Project
In-Reply-To: <b7561e6d6d357fcd8ec1a1257aaf2f97d971061c.camel@infradead.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 18/03/2024 21:25, David Woodhouse wrote:
> On Mon, 2024-03-18 at 09:25 -0700, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    277100b3d5fe Merge tag 'block-6.9-20240315' of git://git.k..
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=17c96aa5180000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=1c6662240382da2
>> dashboard link: https://syzkaller.appspot.com/bug?extid=106a4f72b0474e1d1b33
>> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14358231180000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=110ed231180000
>>
>> Downloadable assets:
>> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-277100b3.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/6872e049b27c/vmlinux-277100b3.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/68ec7230df0f/bzImage-277100b3.xz
> 
> static int __kvm_gpc_refresh(struct gfn_to_pfn_cache *gpc, gpa_t gpa, unsigned long uhva,
>                               unsigned long len)
> {
>          unsigned long page_offset;
>          bool unmap_old = false;
>          unsigned long old_uhva;
>          kvm_pfn_t old_pfn;
>          bool hva_change = false;
>          void *old_khva;
>          int ret;
> 
>          /* Either gpa or uhva must be valid, but not both */
>          if (WARN_ON_ONCE(kvm_is_error_gpa(gpa) == kvm_is_error_hva(uhva)))
>                  return -EINVAL;
> 
> Hm, that comment doesn't match the code. It says "not both", but the
> code also catches the "neither" case. I think the gpa is in %rbx and
> uhva is in %r12, so this is indeed the 'neither' case.
> 
> Is it expected that we can end up with a cache marked active, but with
> the address not valid? Maybe through a race condition with deactive? or
> more likely than that?
> 
> Paul, we should probably add ourselves to MAINTAINERS for pfncache.c
> 

Sorry, missed this. Yes, given the changes we've made, we ought to step up.

   Paul