kernel BUG in memory_bm_free

kernel BUG in memory_bm_free

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5ecbe63baca437585bd4@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at kernel/power/snapshot.c:257!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 2394 Comm: syz-executor.0 Not tainted 5.11.0-rc6-syzkaller-00055-g3aaf0a27ffc2 #0
Hardware name: linux,dummy-virt (DT)
pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--)
pc : free_image_page kernel/power/snapshot.c:257 [inline]
pc : free_image_page kernel/power/snapshot.c:253 [inline]
pc : free_list_of_pages kernel/power/snapshot.c:274 [inline]
pc : memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
lr : free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
sp : ffff8000163dbc50
x29: ffff8000163dbc50 x28: f4ff000025204070 
x27: ffff800012d4c000 x26: f4ff000025204008 
x25: f5ff00002827c700 x24: ffff800012d4c000 
x23: 00007fffffffffff x22: f4ff000025204018 
x21: 0000000000000001 x20: ffff800013b576d0 
x19: f5ff00002827c700 x18: 0000000000000000 
x17: 0000000000000000 x16: 0000000000000000 
x15: 0000000000000000 x14: 0000000000000000 
x13: 0000000000000000 x12: 0000000000000000 
x11: 0000000000000000 x10: 0000000000000000 
x9 : fcff000025205400 x8 : 0000000000000002 
x7 : f6ff000025205000 x6 : 00000000000001ff 
x5 : 0000000000000000 x4 : 0000000000000000 
x3 : ffff800013b576d0 x2 : f4ff00002517e000 
x1 : 0000000000000001 x0 : 0b0000002517e000 
Call trace:
 free_image_page kernel/power/snapshot.c:257 [inline]
 free_list_of_pages kernel/power/snapshot.c:274 [inline]
 memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
 free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
 snapshot_release+0x74/0x90 kernel/power/user.c:120
 __fput+0x78/0x230 fs/file_table.c:280
 ____fput+0x10/0x20 fs/file_table.c:313
 task_work_run+0x80/0x160 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939
 work_pending+0xc/0x3d4
Code: cb000260 d34cfc00 97fcf6fe 35fffc20 (d4210000) 
---[ end trace 174c294156b0dfb3 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot spam -- is it useful? time to ban them from the list? [was Re: kernel BUG in memory_bm_free]

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 1074 bytes --]

On Tue 2021-02-02 21:59:17, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> userspace arch: arm64
> 
> Unfortunately, I don't have any reproducer for this issue yet.

> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+5ecbe63baca437585bd4@syzkaller.appspotmail.com

Important: Follow netiquette. You are sending automated emails to people
that did not consent to it. You are not even providing unsubscribe
link. That's actually illegal here.

Put real name of person responsible in the email. Put [syzbot] in the
subject so that it and any resulting replies can be filtered out.

								Pavel
-- 
http://www.livejournal.com/~pavelmachek

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: kernel BUG in memory_bm_free

[Dmitry Vyukov]

On Wed, Feb 3, 2021 at 6:59 AM syzbot
<syzbot+5ecbe63baca437585bd4@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> userspace arch: arm64
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+5ecbe63baca437585bd4@syzkaller.appspotmail.com

The BUG is:
BUG_ON(!virt_addr_valid(addr));

#syz fix: arm64: Do not pass tagged addresses to __is_lm_address()

> ------------[ cut here ]------------
> kernel BUG at kernel/power/snapshot.c:257!
> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 1 PID: 2394 Comm: syz-executor.0 Not tainted 5.11.0-rc6-syzkaller-00055-g3aaf0a27ffc2 #0
> Hardware name: linux,dummy-virt (DT)
> pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--)
> pc : free_image_page kernel/power/snapshot.c:257 [inline]
> pc : free_image_page kernel/power/snapshot.c:253 [inline]
> pc : free_list_of_pages kernel/power/snapshot.c:274 [inline]
> pc : memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
> lr : free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
> sp : ffff8000163dbc50
> x29: ffff8000163dbc50 x28: f4ff000025204070
> x27: ffff800012d4c000 x26: f4ff000025204008
> x25: f5ff00002827c700 x24: ffff800012d4c000
> x23: 00007fffffffffff x22: f4ff000025204018
> x21: 0000000000000001 x20: ffff800013b576d0
> x19: f5ff00002827c700 x18: 0000000000000000
> x17: 0000000000000000 x16: 0000000000000000
> x15: 0000000000000000 x14: 0000000000000000
> x13: 0000000000000000 x12: 0000000000000000
> x11: 0000000000000000 x10: 0000000000000000
> x9 : fcff000025205400 x8 : 0000000000000002
> x7 : f6ff000025205000 x6 : 00000000000001ff
> x5 : 0000000000000000 x4 : 0000000000000000
> x3 : ffff800013b576d0 x2 : f4ff00002517e000
> x1 : 0000000000000001 x0 : 0b0000002517e000
> Call trace:
>  free_image_page kernel/power/snapshot.c:257 [inline]
>  free_list_of_pages kernel/power/snapshot.c:274 [inline]
>  memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
>  free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
>  snapshot_release+0x74/0x90 kernel/power/user.c:120
>  __fput+0x78/0x230 fs/file_table.c:280
>  ____fput+0x10/0x20 fs/file_table.c:313
>  task_work_run+0x80/0x160 kernel/task_work.c:140
>  tracehook_notify_resume include/linux/tracehook.h:189 [inline]
>  do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939
>  work_pending+0xc/0x3d4
> Code: cb000260 d34cfc00 97fcf6fe 35fffc20 (d4210000)
> ---[ end trace 174c294156b0dfb3 ]---
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

Re: kernel BUG in memory_bm_free

[Catalin Marinas]

On Mon, Mar 15, 2021 at 08:08:06AM +0100, Dmitry Vyukov wrote:
> On Wed, Feb 3, 2021 at 6:59 AM syzbot
> <syzbot+5ecbe63baca437585bd4@syzkaller.appspotmail.com> wrote:
> > syzbot found the following issue on:
> >
> > HEAD commit:    3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> > dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> > userspace arch: arm64
> >
> > Unfortunately, I don't have any reproducer for this issue yet.
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+5ecbe63baca437585bd4@syzkaller.appspotmail.com
> 
> The BUG is:
> BUG_ON(!virt_addr_valid(addr));
> 
> #syz fix: arm64: Do not pass tagged addresses to __is_lm_address()

Does this mean that commit 91cb2c8b072e ("arm64: Do not pass tagged
addresses to __is_lm_address()") fixes the regression? The patch was
merged in -5.11-rc7 I think.

-- 
Catalin

Re: kernel BUG in memory_bm_free

[Dmitry Vyukov]

On Mon, Mar 15, 2021 at 1:09 PM Catalin Marinas <catalin.marinas@arm.com> wrote:
>
> On Mon, Mar 15, 2021 at 08:08:06AM +0100, Dmitry Vyukov wrote:
> > On Wed, Feb 3, 2021 at 6:59 AM syzbot
> > <syzbot+5ecbe63baca437585bd4@syzkaller.appspotmail.com> wrote:
> > > syzbot found the following issue on:
> > >
> > > HEAD commit:    3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> > > git tree:       upstream
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> > > userspace arch: arm64
> > >
> > > Unfortunately, I don't have any reproducer for this issue yet.
> > >
> > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > Reported-by: syzbot+5ecbe63baca437585bd4@syzkaller.appspotmail.com
> >
> > The BUG is:
> > BUG_ON(!virt_addr_valid(addr));
> >
> > #syz fix: arm64: Do not pass tagged addresses to __is_lm_address()
>
> Does this mean that commit 91cb2c8b072e ("arm64: Do not pass tagged
> addresses to __is_lm_address()") fixes the regression? The patch was
> merged in -5.11-rc7 I think.

I hope so.