From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753428AbdLNQgE (ORCPT ); Thu, 14 Dec 2017 11:36:04 -0500 Received: from mail-ve1eur01on0127.outbound.protection.outlook.com ([104.47.1.127]:52544 "EHLO EUR01-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753090AbdLNQgC (ORCPT ); Thu, 14 Dec 2017 11:36:02 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; Subject: Re: BUG: unable to handle kernel paging request in do_futex To: Thomas Gleixner , syzbot Cc: Darren Hart , LKML , Ingo Molnar , Peter Zijlstra , syzkaller-bugs@googlegroups.com, Alexander Potapenko , Dmitry Vyukov References: <001a113ed15ed79d14055f379011@google.com> From: Andrey Ryabinin Message-ID: <3ebb7967-bc0c-bdff-8115-f7fb4eadd563@virtuozzo.com> Date: Thu, 14 Dec 2017 19:39:35 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: HE1PR07CA0016.eurprd07.prod.outlook.com (2603:10a6:7:67::26) To VI1PR08MB2829.eurprd08.prod.outlook.com (2603:10a6:802:19::26) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 093975ae-5c32-40a6-bb13-08d54310c1e9 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(4534020)(4602075)(7168020)(4627115)(201703031133081)(201702281549075)(5600026)(4604075)(2017052603307);SRVR:VI1PR08MB2829; X-Microsoft-Exchange-Diagnostics: 1;VI1PR08MB2829;3:tbW57S3LcdsymdE5iKTjTnCmfFT0zMiTW5Lw58bi6E1v3wa2H4Y+HxNGVd9cfV8llygixQAmVM+8p7EaGPTz6Kmjc+Z27uNTiqJX5vZ+cRXuc70YyTSf/XCVFPHUH8AXSPT3PLcgQfa9RqoIKImhz3aoz6qefP2ilkQ4+KRa7ULUT8PaZeorsi0M9XSc3KaC1qodJW5D5LQWujR7DW+wG5gR4YzpbBZUDPMYwH8G3Rdn37AuD7i1Jqh4545LaH4y;25:NwrgpX7vMID/XCSmyAn/OkfrUx8baOHiHa7gqtCcWGr6e2o1iQQAKTA4ZHp5grSUng8XwsERjpB3VtIQ72CO26Usy1LyK0ODzbxG/RN1SgIl1pvSpputc+YXnyPcx8Me2xd1/6Bah/6xznMoLRAAOPyiOD0CA00pvv2Ed57DzkH8+ATlWTfVJr6W9E6r00jWYrtu5/xSJA7X6hXhID60rhvoqJ3Ue46+YW5HicVstZJITm1LOQBvMGxm21ewWIANqb/FuboI1RhyB3P0v7qa5s+YasTFQ7I3KVktJmGtJxeOTaizQVGfN3rGX36Zk6Z3jxC9a8ORYhWPO0vim7um2A==;31:+VYHKzG1MjX/qbb0VNpsXWPsOHjYYIZJzAfIA4SNTHIJPsarjwjW7t3cwRCFRJa+uII0IsW1IsugH8fa1Xjsv/XahdDLj8jAaNTNBTbctD54sYv2rgpyaTg823L78EFmUO31uVfc9yJEP/QuqI5kXA0QhcAA815/GDW+FHRBVzeRpIksTJrD4t/tGhi4Kt4HUgbH6zxfRUwQVKWBjlM8H7jq8xzZv5r+fC+5VJu+gg0= X-MS-TrafficTypeDiagnostic: VI1PR08MB2829: X-Microsoft-Exchange-Diagnostics: 1;VI1PR08MB2829;20:30WzmmMRXCm5TNmzWMivvLkOrgnPT/1dUF14/DirnFvifPDAMUkNz2MryfqfzIIpaJMGcPhqhCaophG45RTtbSppqHgMIlUGkfZPLDfEhAclyDwTEKV6G0jAfBk9yJrDw7LWpgqAzgoWgf7lyF5FYf1OHPbYmWx2o1DwjBfGP/o0+mueFIK1DNLjp3jANUWg4/9NPvS8xBo2ZKKx0sHIlwGBzaJNCdNQXdAWjTceJu2JhkEAMiNL6JvfucPY6RlB86WTXVSgs/jc1yZiKLy3Nq1ECTdQ/c06YnXz707KYhyBJx55suQBF1EnTAk1YEcnC7dWzOF/EqrXgUxRW0Tz7X/QrjKHvu7GrgclaPaTC97SU5wiA52j1cw8D0gTGyzGGmfbpwr2K1uon0l7144PmU8hwrAWSMXrzowh5FkSa0I=;4:L7B+8KC3DkDn8fYbqM2r++eOGENAkGMtFOvCwcySuGJ4msAimkUmnuLyI13HqlYC1hGEM9fH/RkGbNSkz3ecN4E1rvRJjT5rGkGVRO9WwsYtRI00XmEtfgazVGAWWZYOa0Kfeu6ErJfiixupiSnGBXXrsbiVN7EuT2Pcfx17to8TC4ZWR2jnk72u+exgaEHqo2SuXaPS4P9Uxt9infADgBstuT6Ok3XvK1YEvBeAaq1Z+11O5iGDl/+khinzM6vfBpksu84PM5jDhnxKGyRHFPm9j9rMbe67tVkiljwts+zBlk8wbd45vRDe6QkdQblU X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(84791874153150); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040450)(2401047)(5005006)(8121501046)(3231023)(93006095)(93001095)(10201501046)(3002001)(6041248)(20161123562025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(20161123564025)(6072148)(201708071742011);SRVR:VI1PR08MB2829;BCL:0;PCL:0;RULEID:(100000803101)(100110400095);SRVR:VI1PR08MB2829; X-Forefront-PRVS: 05214FD68E X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6049001)(346002)(376002)(366004)(39840400004)(396003)(24454002)(199004)(189003)(2906002)(110136005)(64126003)(23676004)(45080400002)(50466002)(55236003)(52146003)(478600001)(2486003)(65956001)(229853002)(65806001)(47776003)(25786009)(58126008)(66066001)(52116002)(386003)(77096006)(54906003)(6486002)(16576012)(16526018)(36756003)(7736002)(76176011)(316002)(53936002)(68736007)(230700001)(5660300001)(6116002)(8936002)(305945005)(3846002)(4326008)(2950100002)(5890100001)(59450400001)(31686004)(6246003)(86362001)(65826007)(83506002)(97736004)(6666003)(81156014)(8676002)(53546011)(81166006)(105586002)(575784001)(106356001)(31696002);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR08MB2829;H:[172.16.25.12];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtWSTFQUjA4TUIyODI5OzIzOjE4OVZsMkNQMUJoa3drS2MrV3NtcFNVSEFw?= =?utf-8?B?QXpDRW1mVmtkR09mYnd3UU0rWkVjaUhHYVY4K3RNcHJERW0xSENzM0R0WjE3?= =?utf-8?B?bk9NMitUQ0pSbzlDLzVmc25qdFkxYWZlcG9YY2R1bGJPZUNYclI3KzEyOGNQ?= =?utf-8?B?cndCbkZzYnZDQXFQR2xkaGQ3VWlRd3ppYklld3l4dG5BUmNROFIweW9FbzQ1?= =?utf-8?B?Wmx2UVQzWC9ZdDdmTGdXMEp1RVlxSzcrc2hiSDE2VEhTZXBoN3ZIZXNPdXlX?= =?utf-8?B?RHdFUkJwaGxRWThLbnhGSHpIZnQzVExDSEtXUko5azJxQVN5cUJDRGVnSGtj?= =?utf-8?B?VkQ3L3ZrUVFJdFRnd3JSSitoNUd2MlFHL1JyemthZWZNS2FmQ1BWemRLbVNl?= =?utf-8?B?UGc4ZzVMdFZpTkd2R3FtMGgwZVYxbFQzRytUVForc3ZwTG5HSE9CMkdQYVVX?= =?utf-8?B?di82Unh2UHBHOHdkd0RrTlBEd2NrK2RJUWZJWUhLU0VaVVNpOWdRTkxBNlZE?= =?utf-8?B?VjBNUzRrK3o3K0VCQVJkT1VURTZxUTY4anEweW0zMmhwamNwak1VQUFEb3lq?= =?utf-8?B?eGNNRWgwckNkaE5lQzZQL1pyS04rM1kyOXRZS3AwME1WSEduSDB3MnhtUUpB?= =?utf-8?B?NmRWNm5IMTB5MTRYcC82c1NSeGFwWUl5WlVQWEZzUkJLd293b0lZR3NpSjgx?= =?utf-8?B?djVPRDY0QkRSWm5QQ0RwaG1sVVExdStkZU9YeVBwRzdnQW02Z0JzR0N5NzdS?= =?utf-8?B?NDBBWHJoam9Dd0VBWUM0VW1PWmRBOXlVRkZUcTl3MFlsSllCSlNNMWJscGJD?= =?utf-8?B?bVRjbVMyVjhWYU5oaS9QUFpieFZvNmR0ZW1Xd2o5UXQ2RXdaK3FFRTFVUVhD?= =?utf-8?B?ZC9EOHcxenhlUDJhSVNTU0wxWkZacldkNis2RDhVZzBvcEpLbXVtN2VSSExK?= =?utf-8?B?dTN1Q1RxUjAwZjVBNHkyekh4elloRXhleU5hUGZZU1BxcXd5SGQ2Ri9lVkVC?= =?utf-8?B?Uzl4aWIrS05scXVzemoxTTVJZncxTjhTMVBpQW1uS24yKzVjcmhVWEZwZXpR?= =?utf-8?B?aGsycHhPSXlOTUlSQTRlQ2lPdXVrMkhlRi9xYkgxU2U2b1JVVjZHRHR0NnJp?= =?utf-8?B?Z1JSRzkzNXpQZ1dzaTZEbGJYUE4xMHIyWk5sREI4UnVrMTVnTGp2U3Q4dGVv?= =?utf-8?B?YzVYdmcyTnZWSy9ab2xhNXp1NjUycHlMVFlsZGh0amRlNWlTQnJpKzJ5TGd2?= =?utf-8?B?bUdyTWpnVGVqbFcva0EwZUFtUzNqZTNCbE10WXUxb09Mb3RISU5kc0RqK1pp?= =?utf-8?B?cGdlVnNJdW5CQ2tHNEVBMWZMMU1DcmdlWGpGTi85YzYyMWcrVUNMK1BMSnhK?= =?utf-8?B?Q0gzdGRraGpYKzVxRGgrc0wrT0VMNXdvbjU2WkNudXpmaitsOC9jYVZCYVcr?= =?utf-8?B?TUQvaUY4UDg3azN6Z090dURhQlpJcWU1WVpMV3JXdVBZdGdaV1U3L0dSMFJw?= =?utf-8?B?K05LdFRDZ09MSmtjVXhsbnc3TzNNdktxaEp3ZUNhbTEzLzdHMHY3QU1MMjJS?= =?utf-8?B?NUFVWEF1TjFKTDhnYmR3cGxCaTFjOGJCaGdaQ3ZaL3BQTXhDTEcvREU5UGtj?= =?utf-8?B?dVBGN2VOalFTektkNy85V3VxaDNvVmNEdmJnbVpVTWRsbEJBekpZZ0cwRlZW?= =?utf-8?B?ckVQUFNqTG82NHdCbGh6ZjdGa0ZCS3N6TlNsSEZONTRVTkdqQVF5UlNSdmF4?= =?utf-8?B?c1B2dE9DSGExeGZnTzBDbWdFWW5TQkx4MHZCcnd5NzV5cjNRdFVOaWs2MktJ?= =?utf-8?B?YlM0VDVmM3c3eHNHL0ZmeThZR3ZQbW5tTkZDczVtbmhXL0RmVUx3K1lHQmk5?= =?utf-8?B?V3RTWGpVMVlEdGVQeEM4Y1ZhY0VSVDV2ZUF4YkFHN3V1S2hTUXF6Vld2bDAy?= =?utf-8?B?Rk53M2FZbXVtM1NsQUhDbzNNYUNwQ21RWVlXcnJ5dkhnR1ozU04zZHE5d3ZM?= =?utf-8?Q?Z5NZLj?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR08MB2829;6:SKu2V16oBAnKfTOZGQ7Dpu8vi/TxkpFzNPTGcAmvhcC5AJ2VJ2piU9Tmhi5FRni68H/cHZoLHkR71abOeAV37PR6CHLAHXu7Nr8AWRrzb4IGTC9xxL9vFC5FqSy9SQXVbTk1Q5ABhv13IrV+018B8wPY+Pu6Om4xmkABb30rZFae75olW9KtHOGHnRTUTPO4DKCgFt6ZOad+pZX20ZksdvRAT/dQ8IXrDBpk4NnczC4Joggvnasb2FPrMcjaWoM+m2jIe050EMrE3xXvRGW7h4KhQYwWbzI+wq+0h4/mf2BspdaytGTjgeR5MwuaeTUjw+1k1L+lGhIg+FJgUgEuKMB8KcxebtezbcxQk9xKLFo=;5:KeX5ygYHdwecYMT4Vd2FnjmwGlCmsaa7gRGCwrQUkpZ1t5kpSC+71WEHbIjm38iKNvsOfIIK4nY5t7JIoxxXhx0XL3YRT4GiTQ7oK//+qS7F6rRXcH36oUMXxmUJGVM6p3xlK4X2qurD18cPhX03jgAV08wowTCKAoOFt/e5hm0=;24:/cqcV5Z7/wA3pdIpF5UeCEFt2bHacfs9A4OJzyW3YKd6id3jIUyPkcQ7R3YRNMZnhpNO8XUDQAHLodqh6mscpx5HO8aPA+MmKat9uNxaJls=;7:7gvKVGO22t4TxRGszdDSLtdVpYKKDx11twSUDIA9UygYwhZbnDJBNCsZ4DBwWzsxmM99zweCQA5Dnl+14dfSRfsytE/l4aHt5yHHx4QnLwbA/B5bvz2lqSjEJBG35BkDC8aJNsQ6KMna5fLGK4d1wyRXlptWr+OddPtW4R8rZloTsmngT8Zp8Rjzw3zUhtcK0MN/ydV3g273tmQh07CyO+LHTsfnDFWnkFA/CuaNS3d6aQ7MqxftYk2AfgxTycPB SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR08MB2829;20:j9lr5qSXJu13bbdDeym7penRaaSpcN7A8kSdjBMqZ+gfizr1NNc4JMrO1sAok3I2N6RspfsSrczmtAFIokXN+ButWUp5wFDwxLmTD8CkA/hvYWrpPChh92WmCyNXx9a+53E7rGuJwItk6CSLlsFBXn48qcS1YEpEh7TuqsBH9mk= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Dec 2017 16:35:58.7307 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 093975ae-5c32-40a6-bb13-08d54310c1e9 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB2829 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 12/14/2017 06:31 PM, Thomas Gleixner wrote: > On Thu, 30 Nov 2017, syzbot wrote: >> Hello, >> >> syzkaller hit the following crash on 11fed7829beff10184503fd65e5919926464601a >> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master >> compiler: gcc (GCC) 7.1.1 20170620 >> .config is attached >> Raw console output is attached. >> >> Unfortunately, I don't have any reproducer for this bug yet. >> >> >> BUG: unable to handle kernel paging request at 00000000c314149f > > That's a user space address which is nowhere in the registers. Is that > perhaps pre commit: 328b4ed93b69a ? Seems so. Kernel version is 4.15.0-rc1-next-20171130+ it shouldn't have that commit. >> IP: arch_futex_atomic_op_inuser arch/x86/include/asm/futex.h:67 [inline] >> IP: futex_atomic_op_inuser kernel/futex.c:1588 [inline] >> IP: futex_wake_op kernel/futex.c:1637 [inline] >> IP: do_futex+0x14c8/0x2280 kernel/futex.c:3483 >> PGD 5e28067 P4D 5e28067 PUD 5e2a067 PMD 0 >> Oops: 0002 [#1] SMP KASAN > > ^^^^ X86_PF_WRITE > >> Dumping ftrace buffer: >> (ftrace buffer empty) >> Modules linked in: >> CPU: 0 PID: 14626 Comm: syz-executor6 Not tainted 4.15.0-rc1-next-20171130+ >> #56 >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google >> 01/01/2011 >> task: 000000005f17dad6 task.stack: 000000005af7607c >> RIP: 0010:arch_futex_atomic_op_inuser arch/x86/include/asm/futex.h:67 [inline] >> RIP: 0010:futex_atomic_op_inuser kernel/futex.c:1588 [inline] >> RIP: 0010:futex_wake_op kernel/futex.c:1637 [inline] >> RIP: 0010:do_futex+0x14c8/0x2280 kernel/futex.c:3483 >> RSP: 0018:ffff8801cffafa18 EFLAGS: 00010246 >> RAX: 000000007fffffff RBX: 0000000040000002 RCX: ffffffff8164e3d9 >> RDX: 0000000000000000 RSI: ffffc900034e8000 RDI: 0000000000000000 >> RBP: ffff8801cffafe38 R08: 1ffffffff0d31367 R09: 0000000000000004 >> R10: 0000000000000000 R11: ffffffff8748cd60 R12: ffff8801d0f30180 >> R13: 0000000020000000 R14: dffffc0000000000 R15: ffff8801cffafe10 >> FS: 00007f66305e0700(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: fffffffffffffff8 CR3: 00000001ccc2e000 CR4: 00000000001426f0 > > ^^^^^^^^^^^^^^^^ is a totally different address so its either > completely bogus or the above address is a hashed pointer because > that printk used to be %p and was changed to %px in 328b4ed93b69a > >> DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 >> DR3: 0000000000000000 DR6: 00000000ffff0ff3 DR7: 0000000000bb060a >> Call Trace: >> SYSC_futex kernel/futex.c:3533 [inline] >> SyS_futex+0x260/0x390 kernel/futex.c:3501 >> entry_SYSCALL_64_fastpath+0x1f/0x96 >> RIP: 0033:0x4529d9 >> RSP: 002b:00007f66305dfc58 EFLAGS: 00000212 ORIG_RAX: 00000000000000ca >> RAX: ffffffffffffffda RBX: 00007f66305e0700 RCX: 00000000004529d9 >> RDX: 0000000000000007 RSI: 0000000000000085 RDI: 0000000020062000 >> RBP: 0000000000000000 R08: 0000000020000000 R09: 0000000040000002 >> R10: 000000002085fff0 R11: 0000000000000212 R12: 0000000000000000 >> R13: 0000000000a6f7ff R14: 00007f66305e09c0 R15: 0000000000000000 > > The arguments are: > > RDI uaddr 0000000020062000 > RSI op 0000000000000085 > RDX val 0000000000000007 > RCX utime 00000000004529d9 > R8 uaddr2 0000000020000000 > R9 val2 0000000040000002 > >> Code: 31 d2 0f 1f 00 45 87 65 00 0f 1f 00 89 95 30 fc ff ff e9 1d ff ff ff e8 >> 67 56 0b 00 31 d2 8b bd 00 fc ff ff 0f 1f 00 41 8b 45 00 <89> c1 31 f9 f0 41 >> 0f b1 4d 00 75 f0 0f 1f 00 41 89 c4 89 95 30 > > and the code is: > > 27: 41 8b 45 00 mov 0x0(%r13),%eax > 2b:* 89 c1 mov %eax,%ecx <-- trapping instruction > 2d: 31 f9 xor %edi,%ecx > 2f: f0 41 0f b1 4d 00 lock cmpxchg %ecx,0x0(%r13) > 35: 75 f0 jne 0x27 > > The trapping instruction cannot trap :). Assumed it's the move before that, > then the accessed location is R13 + 0 = 0000000020000000, which is uaddr2 > and entirely correct. > But fault address must be 0xfffffffffffffff8 as per CR2, so it can't be 'mov 0x0(%r13),%eax' either. Right? > And what I completely fail to understand why this triggers at all. That > code section is guarded by an extable fixup so this should never come in. > > Is this a KASAN artifact? > I don't see any evidence for KASAN being involved here. > Thanks, > > tglx >