From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0383EC433E6 for ; Wed, 27 Jan 2021 17:40:58 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 89C3B64DA3 for ; Wed, 27 Jan 2021 17:40:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 89C3B64DA3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References:Message-ID: Subject:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=L7cOAAY2Yp8f+ST0AJlHi8/uz96+3xw9tFH2kiSNVYU=; b=mlSS4aa0gegUOAQkwShTp7wHT W1YkTAoMhBxI5kCx8ylPrUUHrsKhFuTzh8b1vkUmGQtItOKKk40mRY9iyIuE0eaWPywGbgTBf/ZoS e4+vlMn5+t0lKIegZDVrjOc3kY1Lo5U5BfOuu1aE+WMAUTYf3OIkLv96v8f8HCJt6k6p+wKizgLuZ Dxku0/GLeOPuFHFy7BeHQyyGyjzzFwVVnBprSzQ2aTNJfPNv05GCKIwBSPliweGM9Sj8TkXT1S5bZ gQbDPqHVPmcOleV24CHHPpQnkGC7R5vSdBSMbvMN9UDXu5QpMIRBovDM7eb4+mHyrPt3WGFh3KgKM kyhOBffgg==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1l4omg-0000Lm-1N; Wed, 27 Jan 2021 17:39:14 +0000 Received: from mail.kernel.org ([198.145.29.99]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1l4oiU-00011T-4H for linux-arm-kernel@lists.infradead.org; Wed, 27 Jan 2021 17:34:55 +0000 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7B8F664DA8; Wed, 27 Jan 2021 17:34:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1611768892; bh=i6kHf86hLpvjWynPpLsneLVR/FYqJtB9g8RT/GX0Tr8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=KCJaJjgMjSKyieVO4eEAN41pY0xDAHjHDuSNqLlL1y8IyCp4pOivok0N64T+pGuoG YOIwWAGMYTesWPQGD8fy4jIbOKv7Ff3DS5zx5cPNZeKF1o/UyUB7YaMdceXQKjCUIq HL0a5tMHZqR5Semz3f9IV5y7YKMBBZQdMRO9b+whKhLNB63Mcki+Yv9+Z+Qq8FQK8m IGMRZfctb0V8GL/TP2f4xvNIHkkJigJY1QYzxBZ/WRhwvsDjCDgRGGi1oqPQ7zDrID 6dMxH9pcl+f92uoBH1Y+dop6c2AFhp73c/p1sqIMeEujgco1WvQ0YwzC5+NY9FID6D oAcnESnPja+rg== Date: Wed, 27 Jan 2021 17:34:47 +0000 From: Will Deacon To: Dmitry Vyukov Subject: Re: WARNING in __do_kernel_fault Message-ID: <20210127173446.GE358@willie-the-truck> References: <0000000000009bbb7905b9e4a624@google.com> <20210127171453.GC358@willie-the-truck> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210127_123454_385193_AC37262A X-CRM114-Status: GOOD ( 24.59 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , syzbot , Catalin Marinas , syzkaller-bugs , LKML , Andrey Konovalov , Dave Martin , Linux ARM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, Jan 27, 2021 at 06:24:22PM +0100, Dmitry Vyukov wrote: > On Wed, Jan 27, 2021 at 6:15 PM Will Deacon wrote: > > > > On Wed, Jan 27, 2021 at 06:00:30PM +0100, Dmitry Vyukov wrote: > > > On Wed, Jan 27, 2021 at 5:56 PM syzbot > > > wrote: > > > > > > > > Hello, > > > > > > > > syzbot found the following issue on: > > > > > > > > HEAD commit: 2ab38c17 mailmap: remove the "repo-abbrev" comment > > > > git tree: upstream > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=15a25264d00000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=ad43be24faf1194c > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=45b6fce29ff97069e2c5 > > > > userspace arch: arm64 > > > > > > > > Unfortunately, I don't have any reproducer for this issue yet. > > > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > > Reported-by: syzbot+45b6fce29ff97069e2c5@syzkaller.appspotmail.com > > > > > > This happens on arm64 instance with mte enabled. > > > There is a GPF in reiserfs_xattr_init on x86_64 reported: > > > https://syzkaller.appspot.com/bug?id=8abaedbdeb32c861dc5340544284167dd0e46cde > > > so I would assume it's just a plain NULL deref. Is this WARNING not > > > indicative of a kernel bug? Or there is something special about this > > > particular NULL deref? > > > > Congratulations, you're the first person to trigger this warning! > > > > This fires if we take an unexpected data abort in the kernel but when we > > get into the fault handler the page-table looks ok (according to the CPU via > > an 'AT' instruction). Are you using QEMU system emulation? Perhaps its > > handling of AT isn't quite right. > > Yes, it's qemu-system-aarch64 5.2 with -machine virt,mte=on -cpu max. > Do you see any way forward for this issue? Can somehow prove/disprove > it's qemu at fault? > The instance just started running, but it seems to be the most common > crash so far and it seems to happen on _all_ gpf's. > You can see all arm64 crashes so far here: > https://syzkaller.appspot.com/upstream?manager=ci-qemu2-arm64-mte > They all happen in reiserfs_security_init, but locally I got a bunch > of different stacks, e.g.: Your best bet is to hack is_spurious_el1_translation_fault() to dump addr, es and par, then we can help decipher the logs here. It could also easily be a bug in that code, since it hasn't been run before (well, other than contrived testing when I wrote it). Will _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel