From: Catalin Marinas <catalin.marinas@arm.com> To: Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com>, Linux ARM <linux-arm-kernel@lists.infradead.org>, LKML <linux-kernel@vger.kernel.org>, syzkaller-bugs <syzkaller-bugs@googlegroups.com>, tongtiangen@huawei.com, Vincenzo Frascino <vincenzo.frascino@arm.com>, Kefeng Wang <wangkefeng.wang@huawei.com>, Will Deacon <will@kernel.org>, syzbot <syzbot+c2c79c6d6eddc5262b77@syzkaller.appspotmail.com>, Evgenii Stepanov <eugenis@google.com>, Peter Collingbourne <pcc@google.com> Subject: Re: [syzbot] KASAN: invalid-access Read in copy_page Date: Tue, 6 Sep 2022 15:29:50 +0100 [thread overview] Message-ID: <YxdZXvsWr37RrFRk@arm.com> (raw) In-Reply-To: <CACT4Y+YOnTpWT5NCNhsPY=kV=2gFfQkY=7xGdU_1k7AdGhQneg@mail.gmail.com> On Tue, Sep 06, 2022 at 03:40:59PM +0200, Dmitry Vyukov wrote: > On Tue, 6 Sept 2022 at 15:24, Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Mon, Sep 05, 2022 at 11:39:24PM +0200, Andrey Konovalov wrote: > > > Syzbot reported an issue with MTE tagging of user pages, see the report below. > > > > > > Possibly, it's related to your "mm: kasan: Skip unpoisoning of user > > > pages" series. However, I'm not sure what the issue is. > > [...] > > > On Sat, Aug 6, 2022 at 3:31 AM syzbot > > > <syzbot+c2c79c6d6eddc5262b77@syzkaller.appspotmail.com> wrote: > > > > BUG: KASAN: invalid-access in copy_page+0x10/0xd0 arch/arm64/lib/copy_page.S:26 > > > > Read at addr f5ff000017f2e000 by task syz-executor.1/2218 > > > > Pointer tag: [f5], memory tag: [f2] > > [...] > > > > The buggy address belongs to the physical page: > > > > page:000000003e6672be refcount:3 mapcount:2 mapping:0000000000000000 index:0xffffffffe pfn:0x57f2e > > > > memcg:fbff00001ded8000 > > > > anon flags: 0x1ffc2800208001c(uptodate|dirty|lru|swapbacked|arch_2|node=0|zone=0|lastcpupid=0x7ff|kasantag=0xa) > > > > It looks like a copy-on-write where the source page is tagged > > (PG_mte_tagged set) but page_kasan_tag() != 0xff (kasantag == 0xa). The > > page is also swap-backed. Our current assumption is that > > page_kasan_tag_reset() should be called on page allocation and we should > > never end up with a user page without the kasan tag reset. [...] > > Does it take long to reproduce this kasan warning? > > syzbot finds several such cases every day (200 crashes for the past 35 days): > https://syzkaller.appspot.com/bug?extid=c2c79c6d6eddc5262b77 > So once it reaches the tested tree, we should have an answer within a day. That's good to know. BTW, does syzkaller write tags in mmap'ed pages or only issues random syscalls? I'm trying to figure out whether tag 0xf2 was written by the kernel without updating the corresponding page_kasan_tag() or it was syzkaller recolouring the page. -- Catalin
WARNING: multiple messages have this Message-ID (diff)
From: Catalin Marinas <catalin.marinas@arm.com> To: Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com>, Linux ARM <linux-arm-kernel@lists.infradead.org>, LKML <linux-kernel@vger.kernel.org>, syzkaller-bugs <syzkaller-bugs@googlegroups.com>, tongtiangen@huawei.com, Vincenzo Frascino <vincenzo.frascino@arm.com>, Kefeng Wang <wangkefeng.wang@huawei.com>, Will Deacon <will@kernel.org>, syzbot <syzbot+c2c79c6d6eddc5262b77@syzkaller.appspotmail.com>, Evgenii Stepanov <eugenis@google.com>, Peter Collingbourne <pcc@google.com> Subject: Re: [syzbot] KASAN: invalid-access Read in copy_page Date: Tue, 6 Sep 2022 15:29:50 +0100 [thread overview] Message-ID: <YxdZXvsWr37RrFRk@arm.com> (raw) In-Reply-To: <CACT4Y+YOnTpWT5NCNhsPY=kV=2gFfQkY=7xGdU_1k7AdGhQneg@mail.gmail.com> On Tue, Sep 06, 2022 at 03:40:59PM +0200, Dmitry Vyukov wrote: > On Tue, 6 Sept 2022 at 15:24, Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Mon, Sep 05, 2022 at 11:39:24PM +0200, Andrey Konovalov wrote: > > > Syzbot reported an issue with MTE tagging of user pages, see the report below. > > > > > > Possibly, it's related to your "mm: kasan: Skip unpoisoning of user > > > pages" series. However, I'm not sure what the issue is. > > [...] > > > On Sat, Aug 6, 2022 at 3:31 AM syzbot > > > <syzbot+c2c79c6d6eddc5262b77@syzkaller.appspotmail.com> wrote: > > > > BUG: KASAN: invalid-access in copy_page+0x10/0xd0 arch/arm64/lib/copy_page.S:26 > > > > Read at addr f5ff000017f2e000 by task syz-executor.1/2218 > > > > Pointer tag: [f5], memory tag: [f2] > > [...] > > > > The buggy address belongs to the physical page: > > > > page:000000003e6672be refcount:3 mapcount:2 mapping:0000000000000000 index:0xffffffffe pfn:0x57f2e > > > > memcg:fbff00001ded8000 > > > > anon flags: 0x1ffc2800208001c(uptodate|dirty|lru|swapbacked|arch_2|node=0|zone=0|lastcpupid=0x7ff|kasantag=0xa) > > > > It looks like a copy-on-write where the source page is tagged > > (PG_mte_tagged set) but page_kasan_tag() != 0xff (kasantag == 0xa). The > > page is also swap-backed. Our current assumption is that > > page_kasan_tag_reset() should be called on page allocation and we should > > never end up with a user page without the kasan tag reset. [...] > > Does it take long to reproduce this kasan warning? > > syzbot finds several such cases every day (200 crashes for the past 35 days): > https://syzkaller.appspot.com/bug?extid=c2c79c6d6eddc5262b77 > So once it reaches the tested tree, we should have an answer within a day. That's good to know. BTW, does syzkaller write tags in mmap'ed pages or only issues random syscalls? I'm trying to figure out whether tag 0xf2 was written by the kernel without updating the corresponding page_kasan_tag() or it was syzkaller recolouring the page. -- Catalin _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2022-09-06 15:19 UTC|newest] Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-08-06 1:31 [syzbot] KASAN: invalid-access Read in copy_page syzbot 2022-08-06 1:31 ` syzbot 2022-09-05 21:39 ` Andrey Konovalov 2022-09-05 21:39 ` Andrey Konovalov 2022-09-06 13:23 ` Catalin Marinas 2022-09-06 13:23 ` Catalin Marinas 2022-09-06 13:40 ` Dmitry Vyukov 2022-09-06 13:40 ` Dmitry Vyukov 2022-09-06 14:29 ` Catalin Marinas [this message] 2022-09-06 14:29 ` Catalin Marinas 2022-09-06 14:39 ` Andrey Konovalov 2022-09-06 14:39 ` Andrey Konovalov 2022-09-06 16:23 ` Catalin Marinas 2022-09-06 16:23 ` Catalin Marinas 2022-09-27 16:55 ` Andrey Konovalov 2022-09-27 16:55 ` Andrey Konovalov 2022-10-05 12:38 ` James Morse 2022-10-05 12:38 ` James Morse 2022-10-06 10:24 ` Catalin Marinas 2022-10-06 10:24 ` Catalin Marinas
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=YxdZXvsWr37RrFRk@arm.com \ --to=catalin.marinas@arm.com \ --cc=andreyknvl@gmail.com \ --cc=dvyukov@google.com \ --cc=eugenis@google.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=pcc@google.com \ --cc=syzbot+c2c79c6d6eddc5262b77@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ --cc=tongtiangen@huawei.com \ --cc=vincenzo.frascino@arm.com \ --cc=wangkefeng.wang@huawei.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.