From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752239AbdHHO6n (ORCPT <rfc822;w@1wt.eu>);
        Tue, 8 Aug 2017 10:58:43 -0400
Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:36822 "EHLO
        foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1752126AbdHHO6m (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 8 Aug 2017 10:58:42 -0400
Date: Tue, 8 Aug 2017 15:57:33 +0100
From: Mark Rutland <mark.rutland@arm.com>
To: linux-kernel@vger.kernel.org, Mel Gorman <mgorman@suse.de>,
        Davidlohr Bueso <dbueso@suse.de>, Ingo Molnar <mingo@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>, Chris Mason <clm@fb.com>,
        Darren Hart <dvhart@linux.intel.com>, Hugh Dickins <hughd@google.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Sebastian Andrzej Siewior <bigeasy@linutronix.de>, dave@stgolabs.net
Subject: Re: kernel BUG at kernel/futex.c:679 on v4.13-rc3-ish on arm64
Message-ID: <20170808145732.GD19207@leverpostej>
References: <20170808105204.GB19207@leverpostej>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20170808105204.GB19207@leverpostej>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Aug 08, 2017 at 11:52:04AM +0100, Mark Rutland wrote:
> Hi,
> 
> As a heads-up, I hit the below splat when using Syzkaller to fuzz arm64
> VMAP_STACK patches [1] atop of v4.13-rc3. I haven't hit anything else
> major, and so far I haven't had any luck reproducing this, so it may be
> an existing issue that's difficult to hit.
> 
> Note that while reported as a BUG(), it's actually the WARN_ON_ONCE()
> introduced in commit:
> 
>   65d8fc777f6dcfee ("futex: Remove requirement for lock_page() in get_futex_key()")
> 
> ... misreported as I accidentally throw away the flags in __BUG_FLAGS().
> Other than that, I believe BUG() and friends are working correctly.
> 
> The Syzkaller log is huge (1.0M), so rather than attaching it, I've
> uploaded the log, report, and kernel config to:
> 
> http://data.yaey.co.uk/bugs/20170808-futex-bug/
> 
> I'll continue trying to reproduce and minimize this.

AFAICT, get_futex_key() can race with an mmap() changing the page in question,
whereupon things go wrong. So I believe we need to restore some of the page
locking in get_futex_key().

The below test case fires for me in a few seconds on an arm64 platform,
triggering the kernel BUG at kernel/futex.c:679. If left running for longer, I
then get a stream of other BUGs that I believe are a result of the first issue.

Thanks,
Mark.

---->8----
#include <linux/futex.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <unistd.h>

#define NR_FUTEX_THREADS 16

pthread_t threads[NR_FUTEX_THREADS];

void *mem;

#define MEM_PROT        (PROT_READ | PROT_WRITE)
#define MEM_SIZE        65536

static int futex_wrapper(int *uaddr, int op, int val,
                         const struct timespec *timeout,
                         int *uaddr2, int val3)
{
        syscall(SYS_futex, uaddr, op, val, timeout, uaddr2, val3);
}

void *poll_futex(void *unused)
{
        for (;;) {
                futex_wrapper(mem, FUTEX_CMP_REQUEUE_PI, 1, NULL, mem + 4, 1);
        }
}

int main(int argc, char *argv[])
{
        int i;

        mem = mmap(NULL, MEM_SIZE, MEM_PROT,
                   MAP_SHARED | MAP_ANONYMOUS, -1, 0);

        printf("Mapping @ %p\n", mem);

        printf("Creating futex threads...\n");

        for (i = 0; i < NR_FUTEX_THREADS; i++)
                pthread_create(&threads[i], NULL, poll_futex, NULL);

        printf("Flipping mapping...\n");
        for (;;) {
                mmap(mem, MEM_SIZE, MEM_PROT,
                     MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
        }

        return 0;
}