[syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
41 views
Skip to first unread message
syzbot
Dec 2, 2023, 9:17:23 PM12/2/23
to ak...@linux-foundation.org, dan.ca...@linaro.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, linu...@kvack.org, ll...@lists.linux.dev, mike.k...@oracle.com, muchu...@linux.dev, nat...@kernel.org, ndesau...@google.com, sidhart...@oracle.com, syzkall...@googlegroups.com, tr...@redhat.com
Hello,
syzbot found the following issue on:
HEAD commit: df60cee26a2e Merge tag '6.7-rc3-smb3-server-fixes' of git:..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17ad46fce80000
kernel config: https://syzkaller.appspot.com/x/.config?x=bb39fe85d254f638
dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17befd62e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d5a90ce80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c632017e0dc4/disk-df60cee2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f94c8fa25aeb/vmlinux-df60cee2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/af80f80c708b/bzImage-df60cee2.xz
The issue was bisected to:
commit a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3
Author: Sidhartha Kumar <sidhart...@oracle.com>
Date: Tue Sep 26 19:20:17 2023 +0000
mm/filemap: remove hugetlb special casing in filemap.c
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17f61552e80000
final oops: https://syzkaller.appspot.com/x/report.txt?x=140e1552e80000
console output: https://syzkaller.appspot.com/x/log.txt?x=100e1552e80000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6e2cce...@syzkaller.appspotmail.com
Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c")
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 5072 Comm: syz-executor107 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:pagemap_scan_backout_range fs/proc/task_mmu.c:1946 [inline]
RIP: 0010:pagemap_scan_hugetlb_entry+0x6ca/0x1130 fs/proc/task_mmu.c:2254
Code: 3c 02 00 0f 85 68 09 00 00 48 8b 83 80 00 00 00 48 8d 04 40 4d 8d 6c c5 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 51 09 00 00 4d 8b 75 00 48 8b 7c 24 08 4c 89 f6
RSP: 0018:ffffc90003a2fa50 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffc90003a2fdb0 RCX: ffffffff82111e46
RDX: 0000000000000000 RSI: ffffffff82111e54 RDI: ffffc90003a2fe30
RBP: 1ffff92000745f52 R08: 0000000000000006 R09: 0000000020ffc000
R10: 00000000211f9000 R11: ffffffff915f5de8 R12: ffff8880299e0300
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000020ffc000
FS: 0000555555c7b380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 00000000752b4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
walk_hugetlb_range mm/pagewalk.c:326 [inline]
__walk_page_range+0x36c/0x770 mm/pagewalk.c:393
walk_page_range+0x626/0xa80 mm/pagewalk.c:521
do_pagemap_scan+0x40d/0xcd0 fs/proc/task_mmu.c:2437
do_pagemap_cmd+0x5e/0x80 fs/proc/task_mmu.c:2478
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f171819d669
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbe81bb68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fffbe81bb80 RCX: 00007f171819d669
RDX: 0000000020000040 RSI: 00000000c0606610 RDI: 0000000000000003
RBP: 00007f1718210610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000286 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fffbe81bdb8 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:pagemap_scan_backout_range fs/proc/task_mmu.c:1946 [inline]
RIP: 0010:pagemap_scan_hugetlb_entry+0x6ca/0x1130 fs/proc/task_mmu.c:2254
Code: 3c 02 00 0f 85 68 09 00 00 48 8b 83 80 00 00 00 48 8d 04 40 4d 8d 6c c5 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 51 09 00 00 4d 8b 75 00 48 8b 7c 24 08 4c 89 f6
RSP: 0018:ffffc90003a2fa50 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffc90003a2fdb0 RCX: ffffffff82111e46
RDX: 0000000000000000 RSI: ffffffff82111e54 RDI: ffffc90003a2fe30
RBP: 1ffff92000745f52 R08: 0000000000000006 R09: 0000000020ffc000
R10: 00000000211f9000 R11: ffffffff915f5de8 R12: ffff8880299e0300
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000020ffc000
FS: 0000555555c7b380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 00000000752b4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 3c 02 cmp $0x2,%al
2: 00 0f add %cl,(%rdi)
4: 85 68 09 test %ebp,0x9(%rax)
7: 00 00 add %al,(%rax)
9: 48 8b 83 80 00 00 00 mov 0x80(%rbx),%rax
10: 48 8d 04 40 lea (%rax,%rax,2),%rax
14: 4d 8d 6c c5 00 lea 0x0(%r13,%rax,8),%r13
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 4c 89 ea mov %r13,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 51 09 00 00 jne 0x985
34: 4d 8b 75 00 mov 0x0(%r13),%r14
38: 48 8b 7c 24 08 mov 0x8(%rsp),%rdi
3d: 4c 89 f6 mov %r14,%rsi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: df60cee26a2e Merge tag '6.7-rc3-smb3-server-fixes' of git:..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=17ad46fce80000
kernel config: https://syzkaller.appspot.com/x/.config?x=bb39fe85d254f638
dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17befd62e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d5a90ce80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c632017e0dc4/disk-df60cee2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f94c8fa25aeb/vmlinux-df60cee2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/af80f80c708b/bzImage-df60cee2.xz
The issue was bisected to:
commit a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3
Author: Sidhartha Kumar <sidhart...@oracle.com>
Date: Tue Sep 26 19:20:17 2023 +0000
mm/filemap: remove hugetlb special casing in filemap.c
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17f61552e80000
final oops: https://syzkaller.appspot.com/x/report.txt?x=140e1552e80000
console output: https://syzkaller.appspot.com/x/log.txt?x=100e1552e80000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6e2cce...@syzkaller.appspotmail.com
Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c")
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 5072 Comm: syz-executor107 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:pagemap_scan_backout_range fs/proc/task_mmu.c:1946 [inline]
RIP: 0010:pagemap_scan_hugetlb_entry+0x6ca/0x1130 fs/proc/task_mmu.c:2254
Code: 3c 02 00 0f 85 68 09 00 00 48 8b 83 80 00 00 00 48 8d 04 40 4d 8d 6c c5 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 51 09 00 00 4d 8b 75 00 48 8b 7c 24 08 4c 89 f6
RSP: 0018:ffffc90003a2fa50 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffc90003a2fdb0 RCX: ffffffff82111e46
RDX: 0000000000000000 RSI: ffffffff82111e54 RDI: ffffc90003a2fe30
RBP: 1ffff92000745f52 R08: 0000000000000006 R09: 0000000020ffc000
R10: 00000000211f9000 R11: ffffffff915f5de8 R12: ffff8880299e0300
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000020ffc000
FS: 0000555555c7b380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 00000000752b4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
walk_hugetlb_range mm/pagewalk.c:326 [inline]
__walk_page_range+0x36c/0x770 mm/pagewalk.c:393
walk_page_range+0x626/0xa80 mm/pagewalk.c:521
do_pagemap_scan+0x40d/0xcd0 fs/proc/task_mmu.c:2437
do_pagemap_cmd+0x5e/0x80 fs/proc/task_mmu.c:2478
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f171819d669
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbe81bb68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fffbe81bb80 RCX: 00007f171819d669
RDX: 0000000020000040 RSI: 00000000c0606610 RDI: 0000000000000003
RBP: 00007f1718210610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000286 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fffbe81bdb8 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:pagemap_scan_backout_range fs/proc/task_mmu.c:1946 [inline]
RIP: 0010:pagemap_scan_hugetlb_entry+0x6ca/0x1130 fs/proc/task_mmu.c:2254
Code: 3c 02 00 0f 85 68 09 00 00 48 8b 83 80 00 00 00 48 8d 04 40 4d 8d 6c c5 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 51 09 00 00 4d 8b 75 00 48 8b 7c 24 08 4c 89 f6
RSP: 0018:ffffc90003a2fa50 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffc90003a2fdb0 RCX: ffffffff82111e46
RDX: 0000000000000000 RSI: ffffffff82111e54 RDI: ffffc90003a2fe30
RBP: 1ffff92000745f52 R08: 0000000000000006 R09: 0000000020ffc000
R10: 00000000211f9000 R11: ffffffff915f5de8 R12: ffff8880299e0300
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000020ffc000
FS: 0000555555c7b380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 00000000752b4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 3c 02 cmp $0x2,%al
2: 00 0f add %cl,(%rdi)
4: 85 68 09 test %ebp,0x9(%rax)
7: 00 00 add %al,(%rax)
9: 48 8b 83 80 00 00 00 mov 0x80(%rbx),%rax
10: 48 8d 04 40 lea (%rax,%rax,2),%rax
14: 4d 8d 6c c5 00 lea 0x0(%r13,%rax,8),%r13
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 4c 89 ea mov %r13,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 51 09 00 00 jne 0x985
34: 4d 8b 75 00 mov 0x0(%r13),%r14
38: 48 8b 7c 24 08 mov 0x8(%rsp),%rdi
3d: 4c 89 f6 mov %r14,%rsi
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Sidhartha Kumar
Dec 6, 2023, 1:58:29 PM12/6/23
to syzbot, syzkall...@googlegroups.com
#syz test
From: syzbot <syzbot+6e2cce...@syzkaller.appspotmail.com>
Sent: Saturday, December 2, 2023 6:17 PM
To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
Sent: Saturday, December 2, 2023 6:17 PM
To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
syzbot
Dec 6, 2023, 2:07:08 PM12/6/23
to linux-...@vger.kernel.org, sidhart...@oracle.com, syzkall...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
mm/hugetlb.c:6485:17: error: too few arguments to function 'set_huge_pte_at'
Tested on:
commit: bee0e776 Merge tag 'for-linus-iommufd' of git://git.ke..
git tree: upstream
syzbot tried to test the proposed patch but the build/boot failed:
mm/hugetlb.c:6485:17: error: too few arguments to function 'set_huge_pte_at'
Tested on:
commit: bee0e776 Merge tag 'for-linus-iommufd' of git://git.ke..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=bb39fe85d254f638
dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1621e60ee80000
dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syzbot
Dec 6, 2023, 2:11:08 PM12/6/23
to sidhart...@oracle.com, sidhart...@oracle.com, syzkall...@googlegroups.com, linux-...@vger.kernel.org
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/ mm-hotfixes-unstable<https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/log/?h=mm-hotfixes-unstable>
Command #1:
"mm-hotfixes-unstable<https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/log/?h=mm-hotfixes-unstable>" does not look like a valid git branch or commit.
> ________________________________
> From: syzbot <syzbot+6e2cce...@syzkaller.appspotmail.com>
> Sent: Saturday, December 2, 2023 6:17 PM
> To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
> Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: df60cee26a2e Merge tag '6.7-rc3-smb3-server-fixes' of git:..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=17ad46fce80000
> From: syzbot <syzbot+6e2cce...@syzkaller.appspotmail.com>
> Sent: Saturday, December 2, 2023 6:17 PM
> To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
> Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: df60cee26a2e Merge tag '6.7-rc3-smb3-server-fixes' of git:..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=17ad46fce80000
> kernel config: https://syzkaller.appspot.com/x/.config?x=bb39fe85d254f638
> dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
"mm-hotfixes-unstable<https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/log/?h=mm-hotfixes-unstable>" does not look like a valid git branch or commit.
Sidhartha Kumar
Dec 6, 2023, 2:11:08 PM12/6/23
to syzbot, syzkall...@googlegroups.com
From: syzbot <syzbot+6e2cce...@syzkaller.appspotmail.com>
Sent: Saturday, December 2, 2023 6:17 PM
To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
Sent: Saturday, December 2, 2023 6:17 PM
To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
syzbot
Dec 6, 2023, 2:13:35 PM12/6/23
to sidhart...@oracle.com, sidhart...@oracle.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/log/?h=mm-hotfixes-unstable
Command #1:
want either no args or 2 args (repo, branch), got 1
want either no args or 2 args (repo, branch), got 1
syzbot
Dec 6, 2023, 2:16:44 PM12/6/23
to sidhart...@oracle.com, sidhart...@oracle.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
> #syz test git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-unstable<https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/log/?h=mm-hotfixes-unstable>
syzbot
Dec 6, 2023, 2:18:36 PM12/6/23
to linux-...@vger.kernel.org, syzkall...@googlegroups.com
For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: Re: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
Author: sidhart...@oracle.com
linux-...@vger.kernel.org, syzkall...@googlegroups.com.
***
Subject: Re: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
Author: sidhart...@oracle.com
________________________________
From: syzbot <syzbot+6e2cce...@syzkaller.appspotmail.com>
Sent: Saturday, December 2, 2023 6:17 PM
To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
From: syzbot <syzbot+6e2cce...@syzkaller.appspotmail.com>
Sent: Saturday, December 2, 2023 6:17 PM
To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
syzbot
Dec 6, 2023, 2:41:08 PM12/6/23
to linux-...@vger.kernel.org, sidhart...@oracle.com, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+6e2cce...@syzkaller.appspotmail.com
Tested on:
commit: 41f87dea kexec: select CRYPTO from KEXEC_FILE instead ..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-unstable
console output: https://syzkaller.appspot.com/x/log.txt?x=12f729ace80000
kernel config: https://syzkaller.appspot.com/x/.config?x=3513b9514190e290
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+6e2cce...@syzkaller.appspotmail.com
Tested on:
commit: 41f87dea kexec: select CRYPTO from KEXEC_FILE instead ..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-unstable
console output: https://syzkaller.appspot.com/x/log.txt?x=12f729ace80000
kernel config: https://syzkaller.appspot.com/x/.config?x=3513b9514190e290
dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: testing is done by a robot and is best-effort only.
Sidhartha Kumar
Dec 6, 2023, 2:44:43 PM12/6/23
to syzbot, ak...@linux-foundation.org, dan.ca...@linaro.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, linu...@kvack.org, ll...@lists.linux.dev, Mike Kravetz, muchu...@linux.dev, nat...@kernel.org, ndesau...@google.com, syzkall...@googlegroups.com, tr...@redhat.com
#syz
test git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-unstable
mm-hotfixes-unstable
contains four fixes for the pagemap IOCTL code which is what the stack trace indicates is what the reproducer is using.
From: syzbot <syzbot+6e2cce...@syzkaller.appspotmail.com>
Sent: Saturday, December 2, 2023 6:17 PM
To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
Sent: Saturday, December 2, 2023 6:17 PM
To: ak...@linux-foundation.org <ak...@linux-foundation.org>; dan.ca...@linaro.org <dan.ca...@linaro.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linux-...@vger.kernel.org <linux-...@vger.kernel.org>; linu...@kvack.org <linu...@kvack.org>; ll...@lists.linux.dev <ll...@lists.linux.dev>; Mike Kravetz <mike.k...@oracle.com>; muchu...@linux.dev <muchu...@linux.dev>; nat...@kernel.org <nat...@kernel.org>; ndesau...@google.com <ndesau...@google.com>; Sidhartha Kumar <sidhart...@oracle.com>; syzkall...@googlegroups.com <syzkall...@googlegroups.com>; tr...@redhat.com <tr...@redhat.com>
Subject: [syzbot] [fs?] general protection fault in pagemap_scan_hugetlb_entry
syzbot
Dec 6, 2023, 3:36:08 PM12/6/23
to ak...@linux-foundation.org, dan.ca...@linaro.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, linu...@kvack.org, ll...@lists.linux.dev, mike.k...@oracle.com, muchu...@linux.dev, nat...@kernel.org, ndesau...@google.com, sidhart...@oracle.com, syzkall...@googlegroups.com, tr...@redhat.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+6e2cce...@syzkaller.appspotmail.com
Tested on:
commit: 41f87dea kexec: select CRYPTO from KEXEC_FILE instead ..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-unstable
console output: https://syzkaller.appspot.com/x/log.txt?x=144310d4e80000
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+6e2cce...@syzkaller.appspotmail.com
Tested on:
commit: 41f87dea kexec: select CRYPTO from KEXEC_FILE instead ..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-hotfixes-unstable
kernel config: https://syzkaller.appspot.com/x/.config?x=3513b9514190e290
dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syzbot
Dec 30, 2023, 1:24:09 PM12/30/23
to ak...@linux-foundation.org, bra...@kernel.org, dan.ca...@linaro.org, linux-...@vger.kernel.org, linux-...@vger.kernel.org, linu...@kvack.org, ll...@lists.linux.dev, mike.k...@oracle.com, muchu...@linux.dev, nat...@kernel.org, ndesau...@google.com, sidhart...@oracle.com, syzkall...@googlegroups.com, tr...@redhat.com, vi...@zeniv.linux.org.uk
syzbot suspects this issue was fixed by commit:
commit 4a3ef6be03e6700037fc20e63aa5ffd972e435ca
Author: Sidhartha Kumar <sidhart...@oracle.com>
Date: Mon Dec 4 18:32:34 2023 +0000
mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=126d4145e80000
start commit: df60cee26a2e Merge tag '6.7-rc3-smb3-server-fixes' of git:..
git tree: upstream
#syz fix: mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI
commit 4a3ef6be03e6700037fc20e63aa5ffd972e435ca
Author: Sidhartha Kumar <sidhart...@oracle.com>
Date: Mon Dec 4 18:32:34 2023 +0000
mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=126d4145e80000
start commit: df60cee26a2e Merge tag '6.7-rc3-smb3-server-fixes' of git:..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=bb39fe85d254f638
dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
dashboard link: https://syzkaller.appspot.com/bug?extid=6e2ccedb96d1174e6a5f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17befd62e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d5a90ce80000
If the result looks correct, please mark the issue as fixed by replying with:
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d5a90ce80000
#syz fix: mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI
syzbot
Mar 9, 2024, 10:27:17 AM3/9/24
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages