Hello, The following program triggers BUG in pte_list_remove: https://gist.githubusercontent.com/dvyukov/c763720296f6f4e51934c58ade173a71/raw/2f78e3e634dcd8c3d39d2fbbdcd2afb02bc736f5/gistfile1.txt On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (nov 11) kernel BUG at arch/x86/kvm/mmu.c:1016! invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 1923 Comm: syz-executor Not tainted 4.9.0-rc4+ #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88003744c480 task.stack: ffff88003bcc8000 RIP: 0010:[<ffffffff810c6996>] [<ffffffff810c6996>] pte_list_remove+0x3a6/0x3f0 arch/x86/kvm/mmu.c:1015 RSP: 0018:ffff88003bccf660 EFLAGS: 00010286 RAX: 0000000000000028 RBX: ffff88003c2f5d68 RCX: 0000000000000000 RDX: 0000000000000028 RSI: 0000000000000001 RDI: ffffed0007799ec0 RBP: ffff88003bccf6a0 R08: 0000000000000001 R09: 0000000000000000 R10: ffffffff84da2600 R11: 0000000000000001 R12: ffff88003763aa08 R13: 0000000000000000 R14: 000000000000000f R15: ffff88003763aa30 FS: 00007f5cac039700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000006e0000 CR3: 000000003ba9a000 CR4: 00000000000026f0 DR0: 000000000000e3f1 DR1: 0000000000000006 DR2: 0000000000000006 DR3: 0000000000000458 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffff88003c2f5d68 0000000000000001 ffff88003dd43078 ffff88003dd43078 ffff88003763aa08 ffff88003d70c000 000000000000000f ffff88003763aa30 ffff88003bccf6e0 ffffffff810d1eb6 ffff88003744c480 0000000037d8cc77 Call Trace: [< inline >] rmap_remove arch/x86/kvm/mmu.c:1092 [<ffffffff810d1eb6>] drop_spte+0x166/0x260 arch/x86/kvm/mmu.c:1174 [<ffffffff810d267d>] mmu_page_zap_pte+0x19d/0x1e0 arch/x86/kvm/mmu.c:2295 [< inline >] kvm_mmu_page_unlink_children arch/x86/kvm/mmu.c:2317 [<ffffffff810d9486>] kvm_mmu_prepare_zap_page+0x126/0xd60 arch/x86/kvm/mmu.c:2361 [< inline >] kvm_zap_obsolete_pages arch/x86/kvm/mmu.c:4904 [<ffffffff810eb1d4>] kvm_mmu_invalidate_zap_all_pages+0x2d4/0x490 arch/x86/kvm/mmu.c:4945 [<ffffffff810b8055>] kvm_arch_flush_shadow_all+0x15/0x20 arch/x86/kvm/x86.c:8152 [<ffffffff81059d91>] kvm_mmu_notifier_release+0x71/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:467 [<ffffffff8164fe61>] __mmu_notifier_release+0x101/0x3e0 mm/mmu_notifier.c:74 [< inline >] mmu_notifier_release include/linux/mmu_notifier.h:235 [<ffffffff815fe1dc>] exit_mmap+0x32c/0x3d0 mm/mmap.c:2918 [< inline >] __mmput kernel/fork.c:866 [<ffffffff812345c5>] mmput+0x95/0x300 kernel/fork.c:888 [< inline >] exit_mm kernel/exit.c:512 [<ffffffff8124885d>] do_exit+0x71d/0x2bc0 kernel/exit.c:815 [<ffffffff8124efa8>] do_group_exit+0x108/0x330 kernel/exit.c:931 [<ffffffff81271117>] get_signal+0x617/0x1780 kernel/signal.c:2307 [<ffffffff8118294d>] do_signal+0x8d/0x19d0 arch/x86/kernel/signal.c:807 [<ffffffff810039f7>] exit_to_usermode_loop+0xf7/0x150 arch/x86/entry/common.c:156 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [<ffffffff831f0e62>] entry_SYSCALL_64_fastpath+0xc0/0xc2 Code: 71 71 39 00 48 8b 75 d0 48 c7 c7 40 3e 22 83 e8 6a 07 48 00 0f 0b e8 5a 71 39 00 48 8b 75 d0 48 c7 c7 00 3e 22 83 e8 53 07 48 00 <0f> 0b e8 63 48 59 00 e9 c1 fe ff ff e8 f9 48 59 00 e9 4a ff ff RIP [<ffffffff810c6996>] pte_list_remove+0x3a6/0x3f0 arch/x86/kvm/mmu.c:1015 RSP <ffff88003bccf660> ---[ end trace 1cbf703067869156 ]--- Kernel panic - not syncing: Fatal exception Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled reboot: cpu_has_vmx: ecx=80a02021 1 -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
