Messages in this thread | | | Subject | Re: WARNING in __mutex_unlock_slowpath | From | Tetsuo Handa <> | Date | Tue, 8 May 2018 06:49:47 +0900 |
| |
On 2018/05/08 2:19, Paolo Bonzini wrote: >> ------------[ cut here ]------------ >> DEBUG_LOCKS_WARN_ON(__owner_task(owner) != current) >> WARNING: CPU: 0 PID: 4525 at kernel/locking/mutex.c:1032 >> __mutex_unlock_slowpath+0x62e/0x8a0 kernel/locking/mutex.c:1032 >> Kernel panic - not syncing: panic_on_warn set ... > > This doesn't make much sense, unless it's a "generic" memory corruption, > but at least the reproducer seems to be simple, just (in pseudocode) > > ioctl(kvm_vm_fd, KVM_HYPERV_EVENTFD, > { fd = some_eventfd, conn_id = 0, flags = 0 }) > ioctl(kvm_vm_fd, KVM_HYPERV_EVENTFD, > { fd = -1, conn_id = 5, flags = KVM_HYPERV_EVENTFD_DEASSIGN }) >
This makes much sense if this is use-after-free memory access which was manifested differently due to reallocated after released.
mutex_lock(&hv->hv_lock); eventfd = idr_remove(&hv->conn_to_evt, conn_id); // <= Memory block containing hv->hv_lock was released by other thread and reallocated by other thread. mutex_unlock(&hv->hv_lock); // <= Hence, __owner_task(owner) != current at this point.
| |