From: Catalin Marinas <catalin.marinas@arm.com> To: Andrey Konovalov <andreyknvl@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com>, Linux ARM <linux-arm-kernel@lists.infradead.org>, LKML <linux-kernel@vger.kernel.org>, syzkaller-bugs <syzkaller-bugs@googlegroups.com>, tongtiangen@huawei.com, Vincenzo Frascino <vincenzo.frascino@arm.com>, Kefeng Wang <wangkefeng.wang@huawei.com>, Will Deacon <will@kernel.org>, syzbot <syzbot+c2c79c6d6eddc5262b77@syzkaller.appspotmail.com>, Evgenii Stepanov <eugenis@google.com>, Peter Collingbourne <pcc@google.com> Subject: Re: [syzbot] KASAN: invalid-access Read in copy_page Date: Tue, 6 Sep 2022 17:23:39 +0100 [thread overview] Message-ID: <Yxd0C7ndn+iPAGcj@arm.com> (raw) In-Reply-To: <CA+fCnZf-GOZpnBRLkRPrL7FUwYrAb-bu=PV0zMfbKOuNYrZ00A@mail.gmail.com> On Tue, Sep 06, 2022 at 04:39:57PM +0200, Andrey Konovalov wrote: > On Tue, Sep 6, 2022 at 4:29 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > Does it take long to reproduce this kasan warning? > > > > > > syzbot finds several such cases every day (200 crashes for the past 35 days): > > > https://syzkaller.appspot.com/bug?extid=c2c79c6d6eddc5262b77 > > > So once it reaches the tested tree, we should have an answer within a day. > > To be specific, this syzkaller instance fuzzes the mainline, so the > patch with the WARN_ON needs to end up there. > > If this is unacceptable, perhaps, we could switch the MTE syzkaller > instance to the arm64 testing tree. It needs some more digging first. My first guess was that a PROT_MTE page was mapped into the user address space and the task repainted it but I don't think that's the case. > > That's good to know. BTW, does syzkaller write tags in mmap'ed pages or > > only issues random syscalls? > > syzkaller doesn't write tags. Or, at least, shouldn't. Theoretically > it could come up with same way to generate instructions that write > tags, but this is unlikely. Yeah. And colouring an entire page with the same tag is even less likely. > > I'm trying to figure out whether tag 0xf2 > > was written by the kernel without updating the corresponding > > page_kasan_tag() or it was syzkaller recolouring the page. > > Just in case, I want to point out that the kasantag == 0xa from the > page flags matches the pointer tag 0xf5 in the report. The tag value > is stored bitwise-inverted in the page flags. Not that this matters in > this case though. Yes, I'm aware of this. So copy_page() tries to read from page_address(src) with kasantag == 0xa (real tag 0xf5) while the in-memory tag is 0xf2. Since the user didn't repaint the page, I'm trying to figure out what set the tags to 0xf2 while leaving the page_kasan_tag() to 0xf5. Some of the page_kasan_tag_reset() calls in the past could have hidden a different issue. Since I can't find the kernel boot log for these runs, is there any kind of swap enabled? I'm trying to narrow down where the problem may be. -- Catalin
WARNING: multiple messages have this Message-ID (diff)
From: Catalin Marinas <catalin.marinas@arm.com> To: Andrey Konovalov <andreyknvl@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com>, Linux ARM <linux-arm-kernel@lists.infradead.org>, LKML <linux-kernel@vger.kernel.org>, syzkaller-bugs <syzkaller-bugs@googlegroups.com>, tongtiangen@huawei.com, Vincenzo Frascino <vincenzo.frascino@arm.com>, Kefeng Wang <wangkefeng.wang@huawei.com>, Will Deacon <will@kernel.org>, syzbot <syzbot+c2c79c6d6eddc5262b77@syzkaller.appspotmail.com>, Evgenii Stepanov <eugenis@google.com>, Peter Collingbourne <pcc@google.com> Subject: Re: [syzbot] KASAN: invalid-access Read in copy_page Date: Tue, 6 Sep 2022 17:23:39 +0100 [thread overview] Message-ID: <Yxd0C7ndn+iPAGcj@arm.com> (raw) In-Reply-To: <CA+fCnZf-GOZpnBRLkRPrL7FUwYrAb-bu=PV0zMfbKOuNYrZ00A@mail.gmail.com> On Tue, Sep 06, 2022 at 04:39:57PM +0200, Andrey Konovalov wrote: > On Tue, Sep 6, 2022 at 4:29 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > Does it take long to reproduce this kasan warning? > > > > > > syzbot finds several such cases every day (200 crashes for the past 35 days): > > > https://syzkaller.appspot.com/bug?extid=c2c79c6d6eddc5262b77 > > > So once it reaches the tested tree, we should have an answer within a day. > > To be specific, this syzkaller instance fuzzes the mainline, so the > patch with the WARN_ON needs to end up there. > > If this is unacceptable, perhaps, we could switch the MTE syzkaller > instance to the arm64 testing tree. It needs some more digging first. My first guess was that a PROT_MTE page was mapped into the user address space and the task repainted it but I don't think that's the case. > > That's good to know. BTW, does syzkaller write tags in mmap'ed pages or > > only issues random syscalls? > > syzkaller doesn't write tags. Or, at least, shouldn't. Theoretically > it could come up with same way to generate instructions that write > tags, but this is unlikely. Yeah. And colouring an entire page with the same tag is even less likely. > > I'm trying to figure out whether tag 0xf2 > > was written by the kernel without updating the corresponding > > page_kasan_tag() or it was syzkaller recolouring the page. > > Just in case, I want to point out that the kasantag == 0xa from the > page flags matches the pointer tag 0xf5 in the report. The tag value > is stored bitwise-inverted in the page flags. Not that this matters in > this case though. Yes, I'm aware of this. So copy_page() tries to read from page_address(src) with kasantag == 0xa (real tag 0xf5) while the in-memory tag is 0xf2. Since the user didn't repaint the page, I'm trying to figure out what set the tags to 0xf2 while leaving the page_kasan_tag() to 0xf5. Some of the page_kasan_tag_reset() calls in the past could have hidden a different issue. Since I can't find the kernel boot log for these runs, is there any kind of swap enabled? I'm trying to narrow down where the problem may be. -- Catalin _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2022-09-06 16:44 UTC|newest] Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-08-06 1:31 [syzbot] KASAN: invalid-access Read in copy_page syzbot 2022-08-06 1:31 ` syzbot 2022-09-05 21:39 ` Andrey Konovalov 2022-09-05 21:39 ` Andrey Konovalov 2022-09-06 13:23 ` Catalin Marinas 2022-09-06 13:23 ` Catalin Marinas 2022-09-06 13:40 ` Dmitry Vyukov 2022-09-06 13:40 ` Dmitry Vyukov 2022-09-06 14:29 ` Catalin Marinas 2022-09-06 14:29 ` Catalin Marinas 2022-09-06 14:39 ` Andrey Konovalov 2022-09-06 14:39 ` Andrey Konovalov 2022-09-06 16:23 ` Catalin Marinas [this message] 2022-09-06 16:23 ` Catalin Marinas 2022-09-27 16:55 ` Andrey Konovalov 2022-09-27 16:55 ` Andrey Konovalov 2022-10-05 12:38 ` James Morse 2022-10-05 12:38 ` James Morse 2022-10-06 10:24 ` Catalin Marinas 2022-10-06 10:24 ` Catalin Marinas
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=Yxd0C7ndn+iPAGcj@arm.com \ --to=catalin.marinas@arm.com \ --cc=andreyknvl@gmail.com \ --cc=dvyukov@google.com \ --cc=eugenis@google.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=pcc@google.com \ --cc=syzbot+c2c79c6d6eddc5262b77@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ --cc=tongtiangen@huawei.com \ --cc=vincenzo.frascino@arm.com \ --cc=wangkefeng.wang@huawei.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.