From: Sasha Levin <sasha.levin@oracle.com>
To: LKML <linux-kernel@vger.kernel.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Subject: mm: memory corruption on mmput
Date: Sun, 17 Apr 2016 07:12:12 -0400 [thread overview]
Message-ID: <57136F8C.9060307@oracle.com> (raw)
Hi all,
I've hit the following while fuzzing with syzkaller inside a KVM tools guest
running the latest -next kernel:
[ 1065.516003] BUG: Bad page map in process syz-executor pte:00007025 pmd:1b5743067
[ 1065.516016] page:ffffea00000001c0 count:1 mapcount:-1 mapping: (null) index:0x0
[ 1065.516025] flags: 0xfffff80000404(referenced|reserved)
[ 1065.516027] page dumped because: bad pte
[ 1065.516033] addr:0000000000405000 vm_flags:08000875 anon_vma: (null) mapping:ffff8801d2914de8 index:5
[ 1065.516126] file:syz-executor fault:filemap_fault mmap:v9fs_file_mmap readpage:v9fs_vfs_readpage
[ 1065.516173] CPU: 0 PID: 29757 Comm: syz-executor Tainted: G B 4.6.0-rc3-next-20160412-sasha-00023-g0b02d6d-dirty #2998
[ 1065.516194] 0000000000000000 00000000626373ad ffff8801b232f6c0 ffffffff82fc9d01
[ 1065.516202] ffffffff00000000 fffffbfff1bad2a0 0000000041b58ab3 ffffffff8d65eee0
[ 1065.516210] ffffffff82fc9b88 ffff8801b232f6a0 ffffffff816d0a8f 00000000fffffeff
[ 1065.516212] Call Trace:
[ 1065.516238] dump_stack (lib/dump_stack.c:53)
[ 1065.516311] print_bad_pte (mm/memory.c:693 (discriminator 12))
[ 1065.516319] unmap_page_range (mm/memory.c:1163 mm/memory.c:1242 mm/memory.c:1263 mm/memory.c:1284)
[ 1065.516336] unmap_single_vma (mm/memory.c:1329)
[ 1065.516344] unmap_vmas (mm/memory.c:1358 (discriminator 3))
[ 1065.516352] exit_mmap (mm/mmap.c:2757)
[ 1065.516406] mmput (include/linux/compiler.h:222 kernel/fork.c:748 kernel/fork.c:715)
[ 1065.516443] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735)
[ 1065.516468] do_group_exit (kernel/exit.c:862)
[ 1065.516476] get_signal (kernel/signal.c:2307)
[ 1065.516490] do_signal (arch/x86/kernel/signal.c:784)
[ 1065.516572] exit_to_usermode_loop (arch/x86/entry/common.c:231)
[ 1065.516582] prepare_exit_to_usermode (arch/x86/entry/common.c:274)
[ 1065.516592] retint_user (arch/x86/entry/entry_64.S:495)
[ 1065.516728] swap_free: Bad swap file entry 000d2880
[ 1065.516736] BUG: Bad page map in process syz-executor pte:1a510000 pmd:1b5743067
[ 1065.516743] addr:00000000004aa000 vm_flags:08000875 anon_vma: (null) mapping:ffff8801d2914de8 index:aa
[ 1065.516761] file:syz-executor fault:filemap_fault mmap:v9fs_file_mmap readpage:v9fs_vfs_readpage
[ 1065.516770] CPU: 0 PID: 29757 Comm: syz-executor Tainted: G B 4.6.0-rc3-next-20160412-sasha-00023-g0b02d6d-dirty #2998
[ 1065.516779] 0000000000000000 00000000626373ad ffff8801b232f6c0 ffffffff82fc9d01
[ 1065.516787] ffffffff00000000 fffffbfff1bad2a0 0000000041b58ab3 ffffffff8d65eee0
[ 1065.516794] ffffffff82fc9b88 0000000002000200 00000000626373ad ffffea0002d4f5c0
[ 1065.516798] Call Trace:
[ 1065.516807] dump_stack (lib/dump_stack.c:53)
[ 1065.516868] print_bad_pte (mm/memory.c:693 (discriminator 12))
[ 1065.516877] unmap_page_range (mm/memory.c:1185 mm/memory.c:1242 mm/memory.c:1263 mm/memory.c:1284)
[ 1065.516894] unmap_single_vma (mm/memory.c:1329)
[ 1065.516901] unmap_vmas (mm/memory.c:1358 (discriminator 3))
[ 1065.516909] exit_mmap (mm/mmap.c:2757)
[ 1065.516936] mmput (include/linux/compiler.h:222 kernel/fork.c:748 kernel/fork.c:715)
[ 1065.516969] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735)
[ 1065.516994] do_group_exit (kernel/exit.c:862)
[ 1065.517002] get_signal (kernel/signal.c:2307)
[ 1065.517009] do_signal (arch/x86/kernel/signal.c:784)
[ 1065.517059] exit_to_usermode_loop (arch/x86/entry/common.c:231)
[ 1065.517069] prepare_exit_to_usermode (arch/x86/entry/common.c:274)
[ 1065.517077] retint_user (arch/x86/entry/entry_64.S:495)
[ 1065.575917] BUG: Bad page state in process syz-executor pfn:00007
[ 1065.575928] page:ffffea00000001c0 count:0 mapcount:-1 mapping: (null) index:0x0
[ 1065.575933] flags: 0xfffff80000404(referenced|reserved)
[ 1065.575936] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 1065.575939] bad because of flags: 0x400(reserved)
[ 1065.575950] Modules linked in:
[ 1065.575961] CPU: 0 PID: 29757 Comm: syz-executor Tainted: G B 4.6.0-rc3-next-20160412-sasha-00023-g0b02d6d-dirty #2998
[ 1065.575972] 0000000000000000 00000000626373ad ffff8801b232f380 ffffffff82fc9d01
[ 1065.575980] ffffffff00000000 fffffbfff1bad2a0 0000000041b58ab3 ffffffff8d65eee0
[ 1065.575988] ffffffff82fc9b88 ffffffff8152e630 ffffea00000001e0 ffffffff8b307460
[ 1065.575990] Call Trace:
[ 1065.576005] dump_stack (lib/dump_stack.c:53)
[ 1065.576039] bad_page (./arch/x86/include/asm/atomic.h:38 include/linux/mm.h:488 mm/page_alloc.c:464)
[ 1065.576089] free_pages_prepare (mm/page_alloc.c:808 mm/page_alloc.c:1039)
[ 1065.576108] free_hot_cold_page (mm/page_alloc.c:2193)
[ 1065.576145] free_hot_cold_page_list (mm/page_alloc.c:2239 (discriminator 3))
[ 1065.576153] release_pages (mm/swap.c:715)
[ 1065.576190] free_pages_and_swap_cache (mm/swap_state.c:271)
[ 1065.576199] tlb_flush_mmu_free (mm/memory.c:259 (discriminator 4))
[ 1065.576207] unmap_page_range (mm/memory.c:1206 mm/memory.c:1242 mm/memory.c:1263 mm/memory.c:1284)
[ 1065.576224] unmap_single_vma (mm/memory.c:1329)
[ 1065.576232] unmap_vmas (mm/memory.c:1358 (discriminator 3))
[ 1065.576240] exit_mmap (mm/mmap.c:2757)
[ 1065.576268] mmput (include/linux/compiler.h:222 kernel/fork.c:748 kernel/fork.c:715)
[ 1065.576302] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735)
[ 1065.576328] do_group_exit (kernel/exit.c:862)
[ 1065.576335] get_signal (kernel/signal.c:2307)
[ 1065.576344] do_signal (arch/x86/kernel/signal.c:784)
[ 1065.576395] exit_to_usermode_loop (arch/x86/entry/common.c:231)
[ 1065.576404] prepare_exit_to_usermode (arch/x86/entry/common.c:274)
[ 1065.576412] retint_user (arch/x86/entry/entry_64.S:495)
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sasha.levin@oracle.com>
To: LKML <linux-kernel@vger.kernel.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Subject: mm: memory corruption on mmput
Date: Sun, 17 Apr 2016 07:12:12 -0400 [thread overview]
Message-ID: <57136F8C.9060307@oracle.com> (raw)
Hi all,
I've hit the following while fuzzing with syzkaller inside a KVM tools guest
running the latest -next kernel:
[ 1065.516003] BUG: Bad page map in process syz-executor pte:00007025 pmd:1b5743067
[ 1065.516016] page:ffffea00000001c0 count:1 mapcount:-1 mapping: (null) index:0x0
[ 1065.516025] flags: 0xfffff80000404(referenced|reserved)
[ 1065.516027] page dumped because: bad pte
[ 1065.516033] addr:0000000000405000 vm_flags:08000875 anon_vma: (null) mapping:ffff8801d2914de8 index:5
[ 1065.516126] file:syz-executor fault:filemap_fault mmap:v9fs_file_mmap readpage:v9fs_vfs_readpage
[ 1065.516173] CPU: 0 PID: 29757 Comm: syz-executor Tainted: G B 4.6.0-rc3-next-20160412-sasha-00023-g0b02d6d-dirty #2998
[ 1065.516194] 0000000000000000 00000000626373ad ffff8801b232f6c0 ffffffff82fc9d01
[ 1065.516202] ffffffff00000000 fffffbfff1bad2a0 0000000041b58ab3 ffffffff8d65eee0
[ 1065.516210] ffffffff82fc9b88 ffff8801b232f6a0 ffffffff816d0a8f 00000000fffffeff
[ 1065.516212] Call Trace:
[ 1065.516238] dump_stack (lib/dump_stack.c:53)
[ 1065.516311] print_bad_pte (mm/memory.c:693 (discriminator 12))
[ 1065.516319] unmap_page_range (mm/memory.c:1163 mm/memory.c:1242 mm/memory.c:1263 mm/memory.c:1284)
[ 1065.516336] unmap_single_vma (mm/memory.c:1329)
[ 1065.516344] unmap_vmas (mm/memory.c:1358 (discriminator 3))
[ 1065.516352] exit_mmap (mm/mmap.c:2757)
[ 1065.516406] mmput (include/linux/compiler.h:222 kernel/fork.c:748 kernel/fork.c:715)
[ 1065.516443] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735)
[ 1065.516468] do_group_exit (kernel/exit.c:862)
[ 1065.516476] get_signal (kernel/signal.c:2307)
[ 1065.516490] do_signal (arch/x86/kernel/signal.c:784)
[ 1065.516572] exit_to_usermode_loop (arch/x86/entry/common.c:231)
[ 1065.516582] prepare_exit_to_usermode (arch/x86/entry/common.c:274)
[ 1065.516592] retint_user (arch/x86/entry/entry_64.S:495)
[ 1065.516728] swap_free: Bad swap file entry 000d2880
[ 1065.516736] BUG: Bad page map in process syz-executor pte:1a510000 pmd:1b5743067
[ 1065.516743] addr:00000000004aa000 vm_flags:08000875 anon_vma: (null) mapping:ffff8801d2914de8 index:aa
[ 1065.516761] file:syz-executor fault:filemap_fault mmap:v9fs_file_mmap readpage:v9fs_vfs_readpage
[ 1065.516770] CPU: 0 PID: 29757 Comm: syz-executor Tainted: G B 4.6.0-rc3-next-20160412-sasha-00023-g0b02d6d-dirty #2998
[ 1065.516779] 0000000000000000 00000000626373ad ffff8801b232f6c0 ffffffff82fc9d01
[ 1065.516787] ffffffff00000000 fffffbfff1bad2a0 0000000041b58ab3 ffffffff8d65eee0
[ 1065.516794] ffffffff82fc9b88 0000000002000200 00000000626373ad ffffea0002d4f5c0
[ 1065.516798] Call Trace:
[ 1065.516807] dump_stack (lib/dump_stack.c:53)
[ 1065.516868] print_bad_pte (mm/memory.c:693 (discriminator 12))
[ 1065.516877] unmap_page_range (mm/memory.c:1185 mm/memory.c:1242 mm/memory.c:1263 mm/memory.c:1284)
[ 1065.516894] unmap_single_vma (mm/memory.c:1329)
[ 1065.516901] unmap_vmas (mm/memory.c:1358 (discriminator 3))
[ 1065.516909] exit_mmap (mm/mmap.c:2757)
[ 1065.516936] mmput (include/linux/compiler.h:222 kernel/fork.c:748 kernel/fork.c:715)
[ 1065.516969] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735)
[ 1065.516994] do_group_exit (kernel/exit.c:862)
[ 1065.517002] get_signal (kernel/signal.c:2307)
[ 1065.517009] do_signal (arch/x86/kernel/signal.c:784)
[ 1065.517059] exit_to_usermode_loop (arch/x86/entry/common.c:231)
[ 1065.517069] prepare_exit_to_usermode (arch/x86/entry/common.c:274)
[ 1065.517077] retint_user (arch/x86/entry/entry_64.S:495)
[ 1065.575917] BUG: Bad page state in process syz-executor pfn:00007
[ 1065.575928] page:ffffea00000001c0 count:0 mapcount:-1 mapping: (null) index:0x0
[ 1065.575933] flags: 0xfffff80000404(referenced|reserved)
[ 1065.575936] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[ 1065.575939] bad because of flags: 0x400(reserved)
[ 1065.575950] Modules linked in:
[ 1065.575961] CPU: 0 PID: 29757 Comm: syz-executor Tainted: G B 4.6.0-rc3-next-20160412-sasha-00023-g0b02d6d-dirty #2998
[ 1065.575972] 0000000000000000 00000000626373ad ffff8801b232f380 ffffffff82fc9d01
[ 1065.575980] ffffffff00000000 fffffbfff1bad2a0 0000000041b58ab3 ffffffff8d65eee0
[ 1065.575988] ffffffff82fc9b88 ffffffff8152e630 ffffea00000001e0 ffffffff8b307460
[ 1065.575990] Call Trace:
[ 1065.576005] dump_stack (lib/dump_stack.c:53)
[ 1065.576039] bad_page (./arch/x86/include/asm/atomic.h:38 include/linux/mm.h:488 mm/page_alloc.c:464)
[ 1065.576089] free_pages_prepare (mm/page_alloc.c:808 mm/page_alloc.c:1039)
[ 1065.576108] free_hot_cold_page (mm/page_alloc.c:2193)
[ 1065.576145] free_hot_cold_page_list (mm/page_alloc.c:2239 (discriminator 3))
[ 1065.576153] release_pages (mm/swap.c:715)
[ 1065.576190] free_pages_and_swap_cache (mm/swap_state.c:271)
[ 1065.576199] tlb_flush_mmu_free (mm/memory.c:259 (discriminator 4))
[ 1065.576207] unmap_page_range (mm/memory.c:1206 mm/memory.c:1242 mm/memory.c:1263 mm/memory.c:1284)
[ 1065.576224] unmap_single_vma (mm/memory.c:1329)
[ 1065.576232] unmap_vmas (mm/memory.c:1358 (discriminator 3))
[ 1065.576240] exit_mmap (mm/mmap.c:2757)
[ 1065.576268] mmput (include/linux/compiler.h:222 kernel/fork.c:748 kernel/fork.c:715)
[ 1065.576302] do_exit (./arch/x86/include/asm/bitops.h:311 include/linux/thread_info.h:92 kernel/exit.c:437 kernel/exit.c:735)
[ 1065.576328] do_group_exit (kernel/exit.c:862)
[ 1065.576335] get_signal (kernel/signal.c:2307)
[ 1065.576344] do_signal (arch/x86/kernel/signal.c:784)
[ 1065.576395] exit_to_usermode_loop (arch/x86/entry/common.c:231)
[ 1065.576404] prepare_exit_to_usermode (arch/x86/entry/common.c:274)
[ 1065.576412] retint_user (arch/x86/entry/entry_64.S:495)
next reply other threads:[~2016-04-17 11:12 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-17 11:12 Sasha Levin [this message]
2016-04-17 11:12 ` mm: memory corruption on mmput Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=57136F8C.9060307@oracle.com \
--to=sasha.levin@oracle.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.