kernel BUG in memory_bm_free

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5ecbe6...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at kernel/power/snapshot.c:257!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 2394 Comm: syz-executor.0 Not tainted 5.11.0-rc6-syzkaller-00055-g3aaf0a27ffc2 #0
Hardware name: linux,dummy-virt (DT)
pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--)
pc : free_image_page kernel/power/snapshot.c:257 [inline]
pc : free_image_page kernel/power/snapshot.c:253 [inline]
pc : free_list_of_pages kernel/power/snapshot.c:274 [inline]
pc : memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
lr : free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
sp : ffff8000163dbc50
x29: ffff8000163dbc50 x28: f4ff000025204070
x27: ffff800012d4c000 x26: f4ff000025204008
x25: f5ff00002827c700 x24: ffff800012d4c000
x23: 00007fffffffffff x22: f4ff000025204018
x21: 0000000000000001 x20: ffff800013b576d0
x19: f5ff00002827c700 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000
x9 : fcff000025205400 x8 : 0000000000000002
x7 : f6ff000025205000 x6 : 00000000000001ff
x5 : 0000000000000000 x4 : 0000000000000000
x3 : ffff800013b576d0 x2 : f4ff00002517e000
x1 : 0000000000000001 x0 : 0b0000002517e000
Call trace:
free_image_page kernel/power/snapshot.c:257 [inline]
free_list_of_pages kernel/power/snapshot.c:274 [inline]
memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
snapshot_release+0x74/0x90 kernel/power/user.c:120
__fput+0x78/0x230 fs/file_table.c:280
____fput+0x10/0x20 fs/file_table.c:313
task_work_run+0x80/0x160 kernel/task_work.c:140
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939
work_pending+0xc/0x3d4
Code: cb000260 d34cfc00 97fcf6fe 35fffc20 (d4210000)
---[ end trace 174c294156b0dfb3 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Pavel Machek]

On Tue 2021-02-02 21:59:17, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> userspace arch: arm64
>
> Unfortunately, I don't have any reproducer for this issue yet.

> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+5ecbe6...@syzkaller.appspotmail.com

Important: Follow netiquette. You are sending automated emails to people
that did not consent to it. You are not even providing unsubscribe
link. That's actually illegal here.

Put real name of person responsible in the email. Put [syzbot] in the
subject so that it and any resulting replies can be filtered out.

Pavel
--
http://www.livejournal.com/~pavelmachek

[Dmitry Vyukov]

On Wed, Feb 3, 2021 at 6:59 AM syzbot
<syzbot+5ecbe6...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> userspace arch: arm64
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+5ecbe6...@syzkaller.appspotmail.com

The BUG is:
BUG_ON(!virt_addr_valid(addr));

#syz fix: arm64: Do not pass tagged addresses to __is_lm_address()

[Catalin Marinas]

On Mon, Mar 15, 2021 at 08:08:06AM +0100, Dmitry Vyukov wrote:
> On Wed, Feb 3, 2021 at 6:59 AM syzbot
> <syzbot+5ecbe6...@syzkaller.appspotmail.com> wrote:
> > syzbot found the following issue on:
> >
> > HEAD commit: 3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> > dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> > userspace arch: arm64
> >
> > Unfortunately, I don't have any reproducer for this issue yet.
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+5ecbe6...@syzkaller.appspotmail.com
>
> The BUG is:
> BUG_ON(!virt_addr_valid(addr));
>
> #syz fix: arm64: Do not pass tagged addresses to __is_lm_address()

Does this mean that commit 91cb2c8b072e ("arm64: Do not pass tagged
addresses to __is_lm_address()") fixes the regression? The patch was
merged in -5.11-rc7 I think.

--
Catalin

[Dmitry Vyukov]

I hope so.