kernel BUG in vhost_get_vq_desc

Status: fixed on 2023/02/24 13:50
Subsystems: virt kvm net
[Documentation on labels]
Reported-by: syzbot+3140b17cb44a7b174008@syzkaller.appspotmail.com
Fix commit: a58da53ffd70 vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
First crash: 1644d, last: 1614d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in vhost_dev_cleanup (log)
Repro: C syz .config
  
▶ ▼ Discussions (18)
Title Replies (including bot) Last reply
[PATCH 4.19 00/34] 4.19.232-rc1 review 49 (49) 2022/03/17 10:24
[PATCH 4.9 00/29] 4.9.304-rc1 review 36 (36) 2022/03/02 21:01
[syzbot] kernel BUG in vhost_get_vq_desc 4 (6) 2022/03/02 09:23
[PATCH 5.16 000/164] 5.16.12-rc1 review 177 (177) 2022/03/02 07:05
[PATCH 5.15 000/139] 5.15.26-rc1 review 150 (150) 2022/03/02 07:04
[PATCH 5.10 00/80] 5.10.103-rc1 review 89 (89) 2022/03/02 07:04
[PATCH 5.4 00/53] 5.4.182-rc1 review 60 (60) 2022/03/02 07:04
[PATCH 4.14 00/31] 4.14.269-rc1 review 35 (35) 2022/03/01 19:35
[PATCH v2] vhost/vsock: don't check owner in vhost_vsock_stop() while releasing 4 (4) 2022/02/24 08:53
[PATCH] vhost/vsock: don't check owner in vhost_vsock_stop() while releasing 12 (12) 2022/02/22 09:05
Re: [syzbot] kernel BUG in vhost_get_vq_desc 1 (2) 2022/02/21 14:25
Re: [syzbot] kernel BUG in vhost_get_vq_desc 3 (3) 2022/02/21 14:04
Re: [syzbot] kernel BUG in vhost_get_vq_desc 1 (1) 2022/02/21 13:58
Re: [syzbot] kernel BUG in vhost_get_vq_desc 1 (1) 2022/02/21 13:09
Re: [syzbot] kernel BUG in vhost_get_vq_desc 1 (1) 2022/02/21 10:48
Re: [syzbot] kernel BUG in vhost_get_vq_desc 1 (1) 2022/02/21 09:17
Re: [syzbot] kernel BUG in vhost_get_vq_desc 3 (4) 2022/02/20 13:20
Re: [syzbot] kernel BUG in vhost_get_vq_desc 1 (1) 2022/02/20 10:08
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 kernel BUG in vhost_get_vq_desc -1 syz, C error done 19 1597d 1641d 2/2 fixed on 2022/05/13 02:56
linux-4.19 kernel BUG in vhost_get_vq_desc -1 2 1366d 1435d 0/1 auto-obsoleted due to no activity on 2023/02/28 01:46
android-54 kernel BUG in vhost_get_vq_desc -1 syz, C 4 1581d 1621d 0/2 auto-obsoleted due to no activity on 2023/04/21 00:48
linux-4.14 kernel BUG in vhost_get_vq_desc -1 syz, C 1 1254d 1617d 0/1 upstream: reported C repro on 2022/02/22 17:48
upstream kernel BUG at drivers/vhost/vhost.c:LINE! (2) virt kvm net -1 syz, C 139 3004d 3034d 5/29 fixed on 2018/05/08 18:30
upstream kernel BUG at drivers/vhost/vhost.c:LINE! kvm net virt -1 syz, C 152 3035d 3053d 5/29 fixed on 2018/04/06 16:37
▶ ▼ Last patch testing requests (14)
Created Duration User Patch Repo Result
2022/03/02 08:56 12m sgarzare@redhat.com https://github.com/stefano-garzarella/linux.git vsock-fix-stop OK
2022/02/22 03:11 11m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b OK
2022/02/22 00:15 10m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/21 14:10 11m sgarzare@redhat.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b OK
2022/02/21 14:06 7m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b error
2022/02/21 12:50 11m sgarzare@redhat.com https://github.com/stefano-garzarella/linux.git vsock-fix-stop OK
2022/02/21 08:52 13m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/21 05:41 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/21 04:07 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/21 02:12 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/20 13:10 9m mst@redhat.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/20 01:47 12m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b OK
2022/02/19 12:51 9m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log
2022/02/19 11:49 8m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ f71077a4d84b report log

Sample crash report:
------------[ cut here ]------------
kernel BUG at drivers/vhost/vhost.c:2335!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3597 Comm: vhost-3596 Not tainted 5.17.0-rc4-syzkaller-00054-gf71077a4d84b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:vhost_get_vq_desc+0x1d43/0x22c0 drivers/vhost/vhost.c:2335
Code: 00 00 00 48 c7 c6 20 2c 9d 8a 48 c7 c7 98 a6 8e 8d 48 89 ca 48 c1 e1 04 48 01 d9 e8 b7 59 28 fd e9 74 ff ff ff e8 5d c8 a1 fa <0f> 0b e8 56 c8 a1 fa 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90001d1fb88 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff8880234b0000 RSI: ffffffff86d715c3 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff86d706bc R11: 0000000000000000 R12: ffff888072c24d68
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888072c24bb0
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 000000007902c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 vhost_vsock_handle_tx_kick+0x277/0xa20 drivers/vhost/vsock.c:522
 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vhost_get_vq_desc+0x1d43/0x22c0 drivers/vhost/vhost.c:2335
Code: 00 00 00 48 c7 c6 20 2c 9d 8a 48 c7 c7 98 a6 8e 8d 48 89 ca 48 c1 e1 04 48 01 d9 e8 b7 59 28 fd e9 74 ff ff ff e8 5d c8 a1 fa <0f> 0b e8 56 c8 a1 fa 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90001d1fb88 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff8880234b0000 RSI: ffffffff86d715c3 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff86d706bc R11: 0000000000000000 R12: ffff888072c24d68
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888072c24bb0
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 000000007902c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/02/18 01:20 upstream f71077a4d84b 3cd800e4 .config console log report syz C ci-upstream-kasan-gce kernel BUG in vhost_get_vq_desc
2022/02/25 12:50 upstream 73878e5eb1bd 7c337266 .config console log report info ci-upstream-kasan-gce-root kernel BUG in vhost_get_vq_desc
2022/02/24 19:29 upstream 23d04328444a b28851a4 .config console log report info ci-upstream-kasan-gce kernel BUG in vhost_get_vq_desc
2022/02/23 21:50 upstream 5c1ee569660d 6e821dbf .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in vhost_get_vq_desc
2022/02/23 06:57 upstream 917bbdb107f8 6e821dbf .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in vhost_get_vq_desc
2022/02/21 18:25 upstream cfb92440ee71 3cd800e4 .config console log report info ci-upstream-kasan-gce-root kernel BUG in vhost_get_vq_desc
2022/02/17 07:01 upstream 359303076163 2bea8a27 .config console log report info ci-upstream-kasan-gce kernel BUG in vhost_get_vq_desc
2022/02/17 06:46 upstream 359303076163 2bea8a27 .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in vhost_get_vq_desc
2022/02/16 05:29 upstream 705d84a366cf 8b9ca619 .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in vhost_get_vq_desc
2022/02/13 09:15 upstream b81b1829e7e3 8b9ca619 .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in vhost_get_vq_desc
2022/02/12 22:47 upstream 83e396641110 8b9ca619 .config console log report info ci-upstream-kasan-gce-selinux-root kernel BUG in vhost_get_vq_desc
2022/02/11 01:44 upstream e3c85076d7a6 0b33604d .config console log report info ci-upstream-kasan-gce-smack-root kernel BUG in vhost_get_vq_desc
2022/02/08 05:36 upstream 555f3d7be91a a7dab638 .config console log report info ci-upstream-kasan-gce kernel BUG in vhost_get_vq_desc
2022/02/05 03:32 upstream dcb85f85fa6f e13a05ed .config console log report info ci-upstream-kasan-gce kernel BUG in vhost_get_vq_desc
2022/01/26 05:25 upstream 0280e3c58f92 2cbffd88 .config console log report info ci-upstream-kasan-gce kernel BUG in vhost_get_vq_desc
2022/02/20 12:14 linux-next ef6b35306dd8 3cd800e4 .config console log report info ci-upstream-linux-next-kasan-gce-root kernel BUG in vhost_get_vq_desc
2022/02/17 06:56 linux-next ef6b35306dd8 2bea8a27 .config console log report info ci-upstream-linux-next-kasan-gce-root kernel BUG in vhost_get_vq_desc
2022/02/16 05:29 linux-next ef6b35306dd8 8b9ca619 .config console log report info ci-upstream-linux-next-kasan-gce-root kernel BUG in vhost_get_vq_desc
2022/02/14 23:32 linux-next ef6b35306dd8 8b9ca619 .config console log report info ci-upstream-linux-next-kasan-gce-root kernel BUG in vhost_get_vq_desc
* Struck through repros no longer work on HEAD.