On Wed, Jan 4, 2017 at 5:36 AM, Wanpeng Li <kernellwp@xxxxxxxxx> wrote: > 2017-01-03 17:32 GMT+08:00 Dmitry Vyukov <dvyukov@xxxxxxxxxx>: >> On Sat, Nov 12, 2016 at 2:21 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote: >>> Hello, >>> >>> The following programs triggers GPF in irq_bypass_unregister_consumer >>> if run in a parallel loop: >>> https://gist.githubusercontent.com/dvyukov/0d18d7b11659187ec3eab22285b4a67e/raw/c1c622ca26ebce0c7b77e3200970ca0f7792cb32/gistfile1.txt >>> >>> On commit 015ed9433be2b476ec7e2e6a9a411a56e3b5b035 (Nov 11). >>> >>> general protection fault: 0000 [#1] SMP KASAN >>> Dumping ftrace buffer: >>> (ftrace buffer empty) >>> Modules linked in: >>> CPU: 2 PID: 599 Comm: kworker/2:1 Not tainted 4.9.0-rc4+ #41 >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >>> Workqueue: kvm-irqfd-cleanup irqfd_shutdown >>> task: ffff88006cb51700 task.stack: ffff88006cbd8000 >>> RIP: 0010:[<ffffffff831d3957>] [< inline >] __list_del >>> include/linux/list.h:89 >>> RIP: 0010:[<ffffffff831d3957>] [< inline >] list_del >>> include/linux/list.h:107 >>> RIP: 0010:[<ffffffff831d3957>] [<ffffffff831d3957>] >>> irq_bypass_unregister_consumer+0x237/0x360 virt/lib/irqbypass.c:258 >>> RSP: 0018:ffff88006cbdfb68 EFLAGS: 00010202 >>> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88006cb51f00 >>> RDX: 0000000000000001 RSI: ffff88006cb51f50 RDI: 0000000000000008 >>> RBP: ffff88006cbdfb90 R08: 0000000000000000 R09: 0000000000000000 >>> R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003caea638 >>> R13: 0000000000000000 R14: ffffffff83ece9a0 R15: ffff88006bb0a530 >>> FS: 0000000000000000(0000) GS:ffff88006e200000(0000) knlGS:0000000000000000 >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >>> CR2: 00000000006e0000 CR3: 0000000003a1d000 CR4: 00000000000026e0 >>> Stack: >>> ffff88003caea4d0 ffff88003caea5f8 1ffff1000d97bf75 ffff88003caea5d0 >>> dffffc0000000000 ffff88006cbdfc30 ffffffff8106d144 0000000000000000 >>> 0000000041b58ab3 ffffffff837c38d1 ffffffff8106d030 0000000000000246 >>> Call Trace: >>> [<ffffffff8106d144>] irqfd_shutdown+0x114/0x1a0 >>> arch/x86/kvm/../../../virt/kvm/eventfd.c:145 >>> [<ffffffff8129375c>] process_one_work+0x9fc/0x1900 kernel/workqueue.c:2096 >>> [<ffffffff8129474f>] worker_thread+0xef/0x1480 kernel/workqueue.c:2230 >>> [<ffffffff812a7a94>] kthread+0x244/0x2d0 kernel/kthread.c:209 >>> [<ffffffff831ebf6a>] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433 >>> Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b7 00 00 00 49 8d 7d 08 >>> 48 b8 00 00 00 00 00 fc ff df 49 8b 5c 24 08 48 89 fa 48 c1 ea 03 <80> >>> 3c 02 00 0f 85 9d 00 00 00 48 89 da 48 b8 00 00 00 00 00 fc >>> RIP [< inline >] __list_del include/linux/list.h:89 >>> RIP [< inline >] list_del include/linux/list.h:107 >>> RIP [<ffffffff831d3957>] irq_bypass_unregister_consumer+0x237/0x360 >>> virt/lib/irqbypass.c:258 >>> RSP <ffff88006cbdfb68> >>> ---[ end trace 986ec3b53e4e0338 ]--- >>> Kernel panic - not syncing: Fatal exception >>> Dumping ftrace buffer: >>> (ftrace buffer empty) >>> Kernel Offset: disabled >>> reboot: cpu_has_vmx: ecx=80a02021 1 >> >> >> Still happens on c8b4ec8351d21da3299b045b37920e5cf5590793 (Jan 2). >> >> [ 480.585892] irq bypass consumer (token ffff88003e205700) >> registration fails: -16 >> [ 480.686218] BUG: unable to handle kernel NULL pointer dereference >> at 0000000000000008 >> [ 480.686868] IP: irq_bypass_unregister_consumer+0x8d/0xd0 >> [ 480.686993] PGD 0 >> [ 480.686993] >> [ 480.686993] Oops: 0002 [#1] SMP >> [ 480.686993] Modules linked in: >> [ 480.686993] CPU: 3 PID: 585 Comm: kworker/3:1 Not tainted 4.10.0-rc2+ #57 >> [ 480.686993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), >> BIOS Bochs 01/01/2011 >> [ 480.686993] Workqueue: kvm-irqfd-cleanup irqfd_shutdown >> [ 480.686993] task: ffff88007fa3a8c0 task.stack: ffffc90001524000 >> [ 480.686993] RIP: 0010:irq_bypass_unregister_consumer+0x8d/0xd0 >> [ 480.686993] RSP: 0018:ffffc90001527e20 EFLAGS: 00010246 >> [ 480.686993] RAX: 0000000000000000 RBX: ffff88007dfa5170 RCX: 0000000000000004 >> [ 480.686993] RDX: 0000000000000000 RSI: ffff88007dfa50e8 RDI: 0000000000000000 >> [ 480.686993] RBP: ffffc90001527e28 R08: 0000000000000004 R09: ffff88007fd171c0 >> [ 480.686993] R10: 0000006feb214fc0 R11: 0000000000000000 R12: ffff88007dfa5070 >> [ 480.686993] R13: ffff88007fd1e300 R14: 00000000000000c0 R15: ffff88007dfa5150 >> [ 480.686993] FS: 0000000000000000(0000) GS:ffff88007fd00000(0000) >> knlGS:0000000000000000 >> [ 480.686993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> [ 480.686993] CR2: 0000000000000008 CR3: 0000000001e0a000 CR4: 00000000000026e0 >> [ 480.686993] Call Trace: >> [ 480.686993] irqfd_shutdown+0x52/0x70 >> [ 480.686993] process_one_work+0x149/0x3f0 >> [ 480.686993] worker_thread+0x126/0x4a0 >> [ 480.686993] ? __schedule+0x21c/0x660 >> [ 480.686993] kthread+0xfc/0x130 >> [ 480.686993] ? rescuer_thread+0x320/0x320 >> [ 480.686993] ? kthread_park+0x90/0x90 >> [ 480.686993] ret_from_fork+0x25/0x30 >> [ 480.686993] Code: 30 d7 f0 81 75 0e eb 1a 48 8b 3f 48 81 ff 30 d7 >> f0 81 74 0e 48 39 57 10 75 ee 48 89 de e8 cc fb ff ff 48 8b 43 08 48 >> 8b 13 31 ff <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 >> 03 66 >> [ 480.686993] RIP: irq_bypass_unregister_consumer+0x8d/0xd0 RSP: >> ffffc90001527e20 >> [ 480.686993] CR2: 0000000000000008 >> [ 480.686993] ---[ end trace e5a8ddcdf160fccb ]--- > > > case 1: > r[2] = syscall(__NR_open, "/dev/kvm", 0x40042ul, 0, 0, 0, 0, 0, 0); > break; > case 2: > r[3] = execute_syscall(__NR_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0, > 0, 0, 0); > break; > case 3: > r[4] = execute_syscall(__NR_ioctl, r[3], 0xae41ul, 0x3fful, 0, 0, 0, > 0, 0, 0); > break; > case 4: > r[5] = execute_syscall(__NR_ioctl, r[4], 0xae9aul, 0, 0, 0, 0, 0, 0, > 0); > break; > case 5: > r[6] = execute_syscall(__NR_eventfd2, 0x8ul, 0x801ul, 0, 0, 0, 0, 0, > 0, 0); > > What's the meaning of parameter "0x40042ul", “0xae01ul” etc here? strace can shed some light on it: $ strace -f -e ioctl ./a.out -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
