Re: [syzbot] Re: [syzbot] [maple-tree?] BUG: unable to handle kernel paging request in mas_walk

syzbot
2024-06-04T15:06:44Z

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [maple-tree?] BUG: unable to handle kernel paging request in mas_walk
Author: liam.howlett@oracle.com

* syzbot <syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com> [240603 22:23]:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 4a4be1ad3a6e Revert "vfs: Delete the associated dentry whe..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=128638ba980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=bd6024aedb15e15c
> dashboard link: https://syzkaller.appspot.com/bug?extid=c67d06ab25a9bc4adf35
> compiler: aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm64
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=106f71aa980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b4ffc6980000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-4a4be1ad.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/75957361122b/vmlinux-4a4be1ad.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/6c766b0ec377/Image-4a4be1ad.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com
>
> Unable to handle kernel paging request at virtual address 00700000077b9b78

#syz test: git://git.infradead.org/users/jedix/linux-maple.git syz_20240603

> Mem abort info:
> ESR = 0x0000000096000004
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x04: level 0 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> [00700000077b9b78] address between user and kernel address ranges
> Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 1 PID: 3186 Comm: syz-executor162 Not tainted 6.10.0-rc1-syzkaller-00027-g4a4be1ad3a6e #0
> Hardware name: linux,dummy-virt (DT)
> pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
> pc : ma_data_end lib/maple_tree.c:1419 [inline]
> pc : mtree_range_walk lib/maple_tree.c:2771 [inline]
> pc : mas_state_walk lib/maple_tree.c:3678 [inline]
> pc : mas_walk+0x194/0x328 lib/maple_tree.c:4909
> lr : lock_vma_under_rcu+0x58/0x134 mm/memory.c:5840
> sp : ffff800088cabd50
> x29: ffff800088cabd50 x28: f2f0000005e50000 x27: 0000000000000000
> x26: 0000000000000004 x25: f7f0000005c03900 x24: 0000000082000007
> x23: 0000ffff82687800 x22: 0000000000000354 x21: 0000ffff82687800
> x20: 0000ffff82687800 x19: ffff800088cabeb0 x18: ff7ffffffffffbff
> x17: 0000aaaadab2dc00 x16: 1e4e000000ef7371 x15: 0000000000000001
> x14: ffffffffffffffff x13: 0000000000000000 x12: ffff800081e3d1e8
> x11: 0000000000000001 x10: f2700000077b9b8c x9 : f2700000077b9b00
> x8 : 0000ffff82687800 x7 : 0000000000000001 x6 : 000000000000000e
> x5 : 0000000000000001 x4 : ffff800088cabd78 x3 : 0000aaaadab2dc00
> x2 : 000000000000000e x1 : 000000000000000f x0 : f2700000077b9b08
> Call trace:
> ma_data_end lib/maple_tree.c:1418 [inline]
> mtree_range_walk lib/maple_tree.c:2771 [inline]
> mas_state_walk lib/maple_tree.c:3678 [inline]
> mas_walk+0x194/0x328 lib/maple_tree.c:4909
> do_page_fault+0xd4/0x480 arch/arm64/mm/fault.c:567
> do_translation_fault+0xac/0xbc arch/arm64/mm/fault.c:690
> do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:826
> el0_ia+0xa4/0x118 arch/arm64/kernel/entry-common.c:598
> el0t_64_sync_handler+0xd0/0x12c arch/arm64/kernel/entry-common.c:736
> el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
> Code: 91002120 51000426 92401cc2 12001cc6 (f8627802)
> ---[ end trace 0000000000000000 ]---
> ----------------
> Code disassembly (best guess):
> 0: 91002120 add x0, x9, #0x8
> 4: 51000426 sub w6, w1, #0x1
> 8: 92401cc2 and x2, x6, #0xff
> c: 12001cc6 and w6, w6, #0xff
> * 10: f8627802 ldr x2, [x0, x2, lsl #3] <-- trapping instruction
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup