From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756333AbcIGH3l (ORCPT ); Wed, 7 Sep 2016 03:29:41 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:36371 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756179AbcIGH3f (ORCPT ); Wed, 7 Sep 2016 03:29:35 -0400 X-IBM-Helo: d03dlp01.boulder.ibm.com X-IBM-MailFrom: paulmck@linux.vnet.ibm.com Date: Wed, 7 Sep 2016 00:29:30 -0700 From: "Paul E. McKenney" To: Kees Cook Cc: Daniel Borkmann , Dmitry Vyukov , Andrew Morton , David Rientjes , Vladimir Davydov , zijun_hu@zoho.com, Joonsoo Kim , "linux-mm@kvack.org" , LKML , "Kirill A. Shutemov" , Andrey Ryabinin , Konstantin Khlebnikov , syzkaller Subject: Re: mm: GPF in __insert_vmap_area Reply-To: paulmck@linux.vnet.ibm.com References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16090707-0016-0000-0000-00000499442C X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00005721; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000185; SDB=6.00754820; UDB=6.00357265; IPR=6.00527678; BA=6.00004699; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00012605; XFM=3.00000011; UTC=2016-09-07 07:29:32 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16090707-0017-0000-0000-000032B13D62 Message-Id: <20160907072930.GQ3663@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-09-07_05:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1609070113 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Sep 06, 2016 at 05:03:41PM -0400, Kees Cook wrote: > On Sat, Sep 3, 2016 at 8:15 AM, Dmitry Vyukov wrote: > > Hello, > > > > While running syzkaller fuzzer I've got the following GPF: > > > > general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN > > Dumping ftrace buffer: > > (ftrace buffer empty) > > Modules linked in: > > CPU: 2 PID: 4268 Comm: syz-executor Not tainted 4.8.0-rc3-next-20160825+ #8 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > > task: ffff88006a6527c0 task.stack: ffff880052630000 > > RIP: 0010:[] [] > > __list_add_valid+0x26/0xd0 lib/list_debug.c:23 > > RSP: 0018:ffff880052637a18 EFLAGS: 00010202 > > RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90001c87000 > > RDX: 0000000000000001 RSI: ffff88001344cdb0 RDI: 0000000000000008 > > RBP: ffff880052637a30 R08: 0000000000000001 R09: 0000000000000000 > > R10: 0000000000000000 R11: ffffffff8a5deee0 R12: ffff88006cc47230 > > R13: ffff88001344cdb0 R14: ffff88006cc47230 R15: 0000000000000000 > > FS: 00007fbacc97e700(0000) GS:ffff88006d200000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 0000000020de7000 CR3: 000000003c4d2000 CR4: 00000000000006e0 > > DR0: 000000000000001e DR1: 000000000000001e DR2: 0000000000000000 > > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 > > Stack: > > ffff88006cc47200 ffff88001344cd98 ffff88006cc47200 ffff880052637a78 > > ffffffff817bc6d1 ffff88006cc47208 ffffed000d988e41 ffff88006cc47208 > > ffff88006cc3e680 ffffc900035b7000 ffffc900035a7000 ffff88006cc47200 > > Call Trace: > > [< inline >] __list_add_rcu include/linux/rculist.h:51 > > [< inline >] list_add_rcu include/linux/rculist.h:78 > > [] __insert_vmap_area+0x1c1/0x3c0 mm/vmalloc.c:340 > > [] alloc_vmap_area+0x614/0x890 mm/vmalloc.c:458 > > [] __get_vm_area_node+0xe8/0x340 mm/vmalloc.c:1377 > > [] __vmalloc_node_range+0xaa/0x6d0 mm/vmalloc.c:1687 > > [< inline >] __vmalloc_node mm/vmalloc.c:1736 > > [] __vmalloc+0x5b/0x70 mm/vmalloc.c:1742 > > [] bpf_prog_alloc+0x3c/0x190 kernel/bpf/core.c:82 > > [] bpf_prog_create_from_user+0xa9/0x2c0 > > net/core/filter.c:1132 > > [< inline >] seccomp_prepare_filter kernel/seccomp.c:373 > > [< inline >] seccomp_prepare_user_filter kernel/seccomp.c:408 > > [< inline >] seccomp_set_mode_filter kernel/seccomp.c:737 > > [] do_seccomp+0x317/0x1800 kernel/seccomp.c:787 > > [] prctl_set_seccomp+0x34/0x60 kernel/seccomp.c:830 > > [< inline >] SYSC_prctl kernel/sys.c:2157 > > [] SyS_prctl+0x82f/0xc80 kernel/sys.c:2075 > > [] entry_SYSCALL_64_fastpath+0x23/0xc1 > > Code: 00 00 00 00 00 55 48 b8 00 00 00 00 00 fc ff df 48 89 e5 41 54 > > 49 89 fc 48 8d 7a 08 53 48 89 d3 48 89 fa 48 83 ec 08 48 c1 ea 03 <80> > > 3c 02 00 75 7c 48 8b 53 08 48 39 f2 75 37 48 89 f2 48 b8 00 > > RIP [] __list_add_valid+0x26/0xd0 lib/list_debug.c:23 > > RSP > > ---[ end trace 983e625f02f00d9f ]--- > > Kernel panic - not syncing: Fatal exception > > > > On commit 0f98f121e1670eaa2a2fbb675e07d6ba7f0e146f of linux-next. > > Unfortunately it is not reproducible. > > The crashing line is: > > CHECK_DATA_CORRUPTION(next->prev != prev, > > > > It crashed on KASAN check at (%rax, %rdx), this address corresponds to > > next address = 0x8. So next was ~NULL. > > Paul, the RCU torture tests passed with the CONFIG_DEBUG_LIST changes, > IIRC, yes? I'd love to rule out some kind of race condition between > the removal and add code for the checking. Indeed they did. But of course rcutorture is about the RCU implementation, and less about uses of RCU. Thanx, Paul > Daniel, IIRC there was some talk about RCU and BPF? Am I remembering > that correctly? I'm having a hard time imagining how a list add could > fail (maybe a race between two adds)? > > Hmmm > > -Kees > > -- > Kees Cook > Nexus Security >