Path: csiph.com!1.us.feeder.erje.net!feeder.erje.net!2.eu.feeder.erje.net!news.szaf.org!news.unit0.net!news.panservice.it!diesel.cu.mi.it!bofh.it!news.nic.it!robomod
From: Dmitry Vyukov <dvyukov@google.com>
Newsgroups: linux.kernel
Subject: Re: NULL-ptr deref in kvm_arch_vcpu_ioctl under AMD CPUs
Date: Sat, 10 Sep 2016 01:10:01 +0200
Message-ID: <sfD5L-LS-7@gated-at.bofh.it>
References: <r3TUS-6ct-11@gated-at.bofh.it> <s7u9k-7K4-21@gated-at.bofh.it> <s7GNc-7nF-27@gated-at.bofh.it> <sbty1-77M-13@gated-at.bofh.it> <sbQXD-5kV-15@gated-at.bofh.it> <sbSPM-6x2-33@gated-at.bofh.it>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Sender: robomod@news.nic.it
Approved: robomod@news.nic.it
Lines: 49
Organization: linux.* mail to news gateway
Xref: csiph.com linux.kernel:1480432

On Tue, Aug 30, 2016 at 5:03 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>
>
> On 30/08/2016 15:08, Dmitry Vyukov wrote:
>>> > b21629da120   kvm: x86: avoid warning on repeated KVM_SET_TSS_ADDR
>>> > 83676e92389   KVM: x86: avoid vmalloc(0) in the KVM_SET_CPUID
>>> > 78e546c824f   KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number
>>> > c622a3c21ed   KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi
>>> > f8c1b85b252   KVM: x86: avoid vmalloc(0) in the KVM_SET_CPUID
>>> > d14bdb553f9   KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS
>>> > 250715a6171   KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
>>> > 4c5ea0a9cd0   locking/static_key: Fix concurrent static_key_slow_inc()
>>> >
>>> > The last one is responsible for most if not all of the OOPses with
>>> > threads.
>>
>> I've started fuzzing kvm again. No crashes so far.
>
> Fingers crossed! :)


Hi Paolo,

I've noticed that KVM is not actually enabled on my machines. /dev/kvm
is missing. If I mknod it manually, opens return ENODEV.
After several hours of debugging I figured that it seems to be caused by:

commit 91fa0f8e9e2937fd9360f326ad60d51908347afd
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Wed Jun 15 20:55:08 2016 +0200
    KVM: x86: always use "acknowledge interrupt on exit"

If I move VM_EXIT_ACK_INTR_ON_EXIT from min back to opt. /dev/kvm
become functional again (at least I can open it).

To make it clear, it all happens inside of qemu instance. I've tried
using different cpus in qemu, including "host" cpu which is pretty
capable:

model name : Intel(R) Xeon(R) CPU E5-2690 v3 @ 2.60GHz
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov
pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm
constant_tsc arch_perfmon rep_good nopl eagerfpu pni pclmulqdq vmx
ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt
tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm
vnmi ept fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt

So why am I missing VM_EXIT_ACK_INTR_ON_EXIT feature? How does it work
for other users? And how should I fix it in a proper way?