Re: WARNING: CPU: 6 PID: 474 at include/linux/maple_tree.h:712 mmap_region (include/linux/maple_tree.h:556 include/linux/maple_tree.h:731

From: Kees Cook <kees@kernel.org>
To: Mark Brown <broonie@kernel.org>,
	Naresh Kamboju <naresh.kamboju@linaro.org>,
	"Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: linux-mm <linux-mm@kvack.org>,
	"open list:KERNEL SELFTEST FRAMEWORK" 
	<linux-kselftest@vger.kernel.org>,
	Linux ARM <linux-arm-kernel@lists.infradead.org>,
	lkft-triage@lists.linaro.org, regressions@lists.linux.dev,
	Andrew Morton <akpm@linux-foundation.org>,
	Will Deacon <will@kernel.org>,
	Catalin Marinas <catalin.marinas@arm.com>,
	Dan Carpenter <dan.carpenter@linaro.org>,
	Eric Biederman <ebiederm@xmission.com>,
	Kees Cook <keescook@chromium.org>
Subject: Re: WARNING: CPU: 6 PID: 474 at include/linux/maple_tree.h:712 mmap_region (include/linux/maple_tree.h:556 include/linux/maple_tree.h:731
Date: Thu, 09 Nov 2023 21:45:26 -0800	[thread overview]
Message-ID: <B4299DC4-57CF-4CB2-ACB1-A215F429BF6A@kernel.org> (raw)
In-Reply-To: <ZUzmlhvRv66I3J6P@finisterre.sirena.org.uk>

On November 9, 2023 6:03:02 AM PST, Mark Brown <broonie@kernel.org> wrote:
>On Thu, Nov 09, 2023 at 06:57:08PM +0530, Naresh Kamboju wrote:
>> Following kernel panic noticed while running  selftests: exec: load_address
>> on Fastmodels (FVP) running Linux next-20231109.
>> 
>
>Copying in Kees and Eric who maintain the exec API.

I'm traveling tomorrow so I won't be able to investigate this for a couple days. A quick look makes it seem like this is only happening in -next? (This warning was recently added to __mas_set_range?)

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/include/linux/maple_tree.h?id=02eccbc51164b43c5dadc3e5b40922c757075e08

Adding Liam...

-Kees

>
>> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
>> 
>> log:
>> ---
>> 
>> # timeout set to 45
>> # selftests: exec: load_address_16777216
>> [  238.405168] ------------[ cut here ]------------
>> [  238.405244] WARNING: CPU: 6 PID: 474 at
>> include/linux/maple_tree.h:712 mmap_region
>> (include/linux/maple_tree.h:556 include/linux/maple_tree.h:731
>> include/linux/maple_tree.h:747 include/linux/mm.h:1033 mm/mmap.c:2828)
>> [  238.405432] Modules linked in: arm_spe_pmu crct10dif_ce
>> panel_simple pl111_drm drm_dma_helper drm_kms_helper fuse drm
>> backlight dm_mod ip_tables x_tables
>> [  238.405932] CPU: 6 PID: 474 Comm: load_address_16 Not tainted
>> 6.6.0-next-20231109 #1
>> [  238.406070] Hardware name: FVP Base RevC (DT)
>> [  238.406151] pstate: 123402009 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
>> [  238.406294] pc : mmap_region (include/linux/maple_tree.h:556
>> include/linux/maple_tree.h:731 include/linux/maple_tree.h:747
>> include/linux/mm.h:1033 mm/mmap.c:2828)
>> [  238.406424] lr : mmap_region (mm/mmap.c:2836)
>> [  238.406554] sp : ffff8000819639b0
>> [  238.406629] x29: ffff8000819639c0 x28: ffff000806f79000 x27: 0000000002002000
>> [  238.406829] x26: ffff000806f798f0 x25: ffff000806f790b0 x24: 0000000000000006
>> [  238.407029] x23: 0000000000000ffc x22: ffff000805d6e100 x21: ffff0008016adf00
>> [  238.407229] x20: 0000000000100073 x19: 0000000001ffc000 x18: ffffffffffffffff
>> [  238.407425] x17: 0000000000000000 x16: ffffd7c64ceb7c10 x15: ffffffffffffffff
>> [  238.407627] x14: 0000000000000000 x13: 1fffe001002bc9a1 x12: ffff0008015e4d0c
>> [  238.407825] x11: ffff800081963a48 x10: ffff0008015e4d00 x9 : ffffd7c64b49c9f0
>> [  238.408028] x8 : ffff800081963778 x7 : 0000000000000000 x6 : 0000000000000000
>> [  238.408223] x5 : ffffd7c64e35f000 x4 : ffffd7c64e35f278 x3 : 0000000000000000
>> [  238.408420] x2 : ffffd7c64e92fd78 x1 : 0000000002001fff x0 : 0000000000479fff
>> [  238.408618] Call trace:
>> [  238.408681] mmap_region (include/linux/maple_tree.h:556
>> include/linux/maple_tree.h:731 include/linux/maple_tree.h:747
>> include/linux/mm.h:1033 mm/mmap.c:2828)
>> [  238.408812] do_mmap (arch/arm64/include/asm/mman.h:18
>> include/linux/mman.h:147 mm/mmap.c:1274)
>> [  238.408940] vm_mmap_pgoff (mm/util.c:546)
>> [  238.409088] vm_mmap (mm/util.c:559)
>> [  238.409229] elf_load (fs/binfmt_elf.c:385 fs/binfmt_elf.c:408)
>> [  238.409337] load_elf_binary (fs/binfmt_elf.c:1134 (discriminator 1))
>> [  238.409454] bprm_execve (fs/exec.c:1940)
>> [  238.409598] do_execveat_common.isra.0 (fs/exec.c:1938)
>> [  238.409757] __arm64_sys_execve (fs/exec.c:2106)
>> [  238.409910] invoke_syscall (arch/arm64/kernel/syscall.c:46
>> (discriminator 19))
>> [  238.410058] el0_svc_common.constprop.0 (arch/arm64/kernel/syscall.c:136)
>> [  238.410218] do_el0_svc (arch/arm64/kernel/syscall.c:155)
>> [  238.410363] el0_svc (arch/arm64/include/asm/daifflags.h:75
>> arch/arm64/kernel/entry-common.c:677)
>> [  238.410508] el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:697)
>> [  238.410623] el0t_64_sync (arch/arm64/kernel/entry.S:595)
>> [  238.410735] ---[ end trace 0000000000000000 ]---
>> 
>> 
>> Links:
>>  - https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20231109/testrun/21009598/suite/log-parser-test/test/check-kernel-exception/log
>>  - https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20231109/testrun/21009598/suite/log-parser-test/tests/
>>  - https://tuxapi.tuxsuite.com/v1/groups/linaro/projects/lkft/tests/2Xv9wca3SPRN4lh73fIuUxVRNHI
>>  - https://storage.tuxsuite.com/public/linaro/lkft/builds/2Xv9vEpjybxlDA4IvgDBm4bjzVT/
>> 
>> --
>> Linaro LKFT
>> https://lkft.linaro.org

-- 
Kees Cook