From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1755745AbcETQ7F (ORCPT <rfc822;w@1wt.eu>);
	Fri, 20 May 2016 12:59:05 -0400
Received: from userp1040.oracle.com ([156.151.31.81]:25724 "EHLO
	userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752075AbcETQ7D (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Fri, 20 May 2016 12:59:03 -0400
Subject: Re: [PATCH v6 2/8] debugfs: prevent access to removed files' private
 data
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
References: <1458652280-19785-1-git-send-email-nicstange@gmail.com>
 <1458652280-19785-3-git-send-email-nicstange@gmail.com>
 <573C80C8.6090307@oracle.com> <87r3czxvea.fsf@gmail.com>
 <573C87B8.902@oracle.com> <20160518160520.GA5407@kroah.com>
Cc: Nicolai Stange <nicstange@gmail.com>,
        Rasmus Villemoes <linux@rasmusvillemoes.dk>,
        "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
        Alexander Viro <viro@zeniv.linux.org.uk>,
        Jonathan Corbet <corbet@lwn.net>, Jan Kara <jack@suse.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Julia Lawall <Julia.Lawall@lip6.fr>,
        Gilles Muller <Gilles.Muller@lip6.fr>,
        Nicolas Palix <nicolas.palix@imag.fr>, Michal Marek <mmarek@suse.com>,
        linux-kernel@vger.kernel.org, cocci@systeme.lip6.fr
From: Sasha Levin <sasha.levin@oracle.com>
Message-ID: <573F4200.3080208@oracle.com>
Date: Fri, 20 May 2016 12:57:36 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.6.0
MIME-Version: 1.0
In-Reply-To: <20160518160520.GA5407@kroah.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
X-Source-IP: aserv0021.oracle.com [141.146.126.233]
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 05/18/2016 12:05 PM, Greg Kroah-Hartman wrote:
> On Wed, May 18, 2016 at 11:18:16AM -0400, Sasha Levin wrote:
>> On 05/18/2016 11:01 AM, Nicolai Stange wrote:
>>> Thanks a million for reporting!
>>>
>>> 1.) Do you have lockdep enabled?
>>
>> Yup, nothing there.
>>
>>> 2.) Does this happen before or after userspace init has been spawned,
>>>     i.e. does the lockup happen at debugfs file creation time or
>>>     possibly at usage time?
>>
>> So I looked closer, and it seems to happen after starting syzkaller, which
>> as far as I know tries to open many different debugfs files.
>>
>> Is there debug code I can add it that'll help us figure out what's up?
> 
> Trying to figure out _which_ debugfs file is causing this would be
> great, if at all possible.  strace?

What seems to be failing is syzkaller's attempt to mmap the coverage
debugfs file. So this isn't actually a kernel deadlock but syzkaller
misbehaves when that scenario happens.

Either way, it only fails to mmap with that commit that I've pointed
out.

	th->cover_fd = open("/sys/kernel/debug/kcov", O_RDWR);
	if (th->cover_fd == -1)
		fail("open of /sys/kernel/debug/kcov failed");
	if (ioctl(th->cover_fd, KCOV_INIT_TRACE, kCoverSize))
		fail("cover enable write failed");
	th->cover_data = (uintptr_t*)mmap(NULL, kCoverSize * sizeof(th->cover_data[0]), PROT_READ | PROT_WRITE, MAP_SHARED, th->cover_fd, 0);
	if ((void*)th->cover_data == MAP_FAILED)
		fail("cover mmap failed");

And it's the mmap() that fails with -ENODEV.


Thanks,
Sasha