From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2AB9C433DB for ; Fri, 12 Mar 2021 08:41:37 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6BACF64FC9 for ; Fri, 12 Mar 2021 08:41:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6BACF64FC9 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arndb.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Cc:To:Subject:Message-ID:Date:From:In-Reply-To: References:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=FIzkWQHIzWXNGW5KYtSpKA85810glk7mCjCsg7csBJQ=; b=I09h1pW8ViU7Zq8nsd5bOKCng AvGc7wVNM4DDfp4WzWP4mHugKJREUWMGCpRiLa8sf3wYdM3+3w1qaEazMPIeHUG9mo2Pzb2bDz6rZ oUX79cipL0tup02UYd29lSM8tNxcdT12QoXkutS0SfjW+XHlnO4XGJlUXMO6avhIDgYN+rwgHIgJI adSwZYc4ZUuxpDb9/dat8TwLQt6YoTyaQ3+4XFdAFI7JtF57vNNwIi6F+8xSOUCSCvwSKWvF2jQUE A+I5Yhp0qzYnEVVsNr+9dJ+HBN16LwR/BnNYtW0eTffnhFHbZQWReYsYBlxhsYnCzis1P948RgNib zN2vu4Y8Q==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lKdLH-00Au9I-RI; Fri, 12 Mar 2021 08:40:20 +0000 Received: from mout.kundenserver.de ([212.227.126.135]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lKdL9-00Au7V-Tw for linux-arm-kernel@lists.infradead.org; Fri, 12 Mar 2021 08:40:14 +0000 Received: from mail-ot1-f50.google.com ([209.85.210.50]) by mrelayeu.kundenserver.de (mreue012 [213.165.67.97]) with ESMTPSA (Nemesis) id 1M5Qhx-1lLSox3px7-001RU2 for ; Fri, 12 Mar 2021 09:40:11 +0100 Received: by mail-ot1-f50.google.com with SMTP id j22so3176330otp.2 for ; Fri, 12 Mar 2021 00:40:10 -0800 (PST) X-Gm-Message-State: AOAM5333fBfhNpqYRNyT8e0MwziwFWxXRxui403cciEq0TB51ff4cLMK Cz4Fp/gqv6WdeCf18X99HrCfz46eAKrN3yCdVS8= X-Google-Smtp-Source: ABdhPJwmWRknWAXyknHhULYipa3e0PU0+89BL/xcwaOgnIpdo8m0SjaiJsDY1UKOPAvk3wFmMHUSdMGjuLDgjnVO3vI= X-Received: by 2002:a05:6830:148c:: with SMTP id s12mr2610357otq.251.1615538409449; Fri, 12 Mar 2021 00:40:09 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Arnd Bergmann Date: Fri, 12 Mar 2021 09:39:53 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: arm64 syzbot instances To: Dmitry Vyukov Cc: Mark Rutland , Marc Zyngier , Will Deacon , Ard Biesheuvel , Linux ARM , syzkaller , LKML , John Garry X-Provags-ID: V03:K1:KUuLXz7yn6OT64p4s7gvlnmS2t8I1pCTtFvWHZLPXDUaudyTsdz Lo8cMXnJpQX/cFl5q924keO1jfDUgIbs12pyaNlYKGSHdjrxyOSXZLAj8oDkxl0EfkPytah ExUAJgkre5zNWITEvbmLhPFo89ypyw+uhfTWS62MVOTtyM3yVT6jH9tizkBm8E2RdooBjMI T8pglUdhWHmEWYu+w1J6A== X-UI-Out-Filterresults: notjunk:1;V03:K0:MpHYiLiMMuU=:2Un/RO2NXADZp73PU+0N4Y fEVzaqMIPtXn0gyGgGwP/1nuhYn3m+M1cXQ5K2emd4WlDbNh5g1cRfxUB4pFR3EBXKrV/3d/B C8AtymKsiB/uzTO7hbqDEZf98TD/JIhZAUNmNtnP2OoSof+q6iEqUVGpvDv1bDgtJGhjvDK0r SCpNs/ugE/jFQraQis5IiaW2saiPuGZ7PeafadRJOUtNUVxkSNSZGeBsXZnYqJMX+XRv+Fi7d 68aUyodXiQR6YrdeMSKg2p1iL78u5j/pq595sFPy5FbdJ/YcKoza7YhAzsiAxcK4MsQVKhLBb pcn3a5i1QuRnMt1TyGN6JNvLFL24BCj/uMM1Bo1mAd6TTGxqSdj4ore1+FWmm5Sya/n1Jg3WE sCtT4ZUXjXkEgkkXbJCu/st9kX2iCb/OhgxqGGvXXRVlq4/MqTr+MISoZ2ZwB X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210312_084012_204483_78972052 X-CRM114-Status: GOOD ( 36.20 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, Mar 11, 2021 at 6:57 PM Dmitry Vyukov wrote: > On Thu, Mar 11, 2021 at 2:30 PM Arnd Bergmann wrote: > > > > > > The instances found few arm64-specific issues that we have not > > > observed on other instances: > > > > I've had a brief look at these: > > > > > https://syzkaller.appspot.com/bug?id=1d22a2cc3521d5cf6b41bd6b825793c2015f861f > > > > This one doesn't seem arm64 specific at all. While the KASAN report has shown > > up on arm64, the link to > > https://syzkaller.appspot.com/bug?id=aa8808729c0a3540e6a29f0d45394665caf79dca > > seems to be for x86 machines running into the same problem. > > > > Looking deeper into the log, I see that fw_load_sysfs_fallback() finds > > an existing > > list entry on the global "pending_fw_head" list, which seems to have been freed > > earlier (the allocation listed here is not for a firmware load, so presumably it > > was recycled in the meantime). The log shows that this is the second time that > > loading the regulatory database failed in that run, so my guess is that it was > > the first failed load that left the freed firmware private data on the > > list, but I > > don't see how that happened. > > > > > https://syzkaller.appspot.com/bug?id=bb2c16b0e13b4de4bbf22cf6a4b9b16fb0c20eea > > > > This one rings a bell: opening a 8250 uart on a well-known port must fail > > when no I/O ports are registered in the system, or when the PCI I/O ports > > are mapped to an invalid area. > > > > It seems to be attempting a register access at I/O port '1' (virtual > > address 0xfffffbfffe800001 is one byte into the well-known PCI_IOBASE), > > which is an unusual place for a UART, traditional PCs had it at 0x3F8. > > > > This could be either a result of qemu claiming to support a PIO based UART > > at the first available address, or the table of UARTS being uninitialized > > .bss memory. > > > > Definitely an arm64 specific bug. > > I can reproduce this with just: > > #include > #include > #include > #include > #include > > int main(void) > { > int fd = syscall(__NR_openat, 0xffffffffffffff9cul, "/dev/ttyS3", 0ul, 0ul); > char ch = 0; > syscall(__NR_ioctl, fd, 0x5412, &ch); // TIOCSTI > return 0; > } > > > It does not even do any tty setup... does it point to a qemu bug? There are at least two bugs here, but both could be either in the kernel or in qemu: a) accessing a legacy ISA/LPC port should not result in an oops, but should instead return values with all bits set. There could be a ratelimited console warning about broken drivers, but we can't assume that all drivers work correctly, as some ancient PC style drivers still rely on this. John Garry has recently worked on a related bugfix, so maybe either this is the same bug he encountered (and hasn't merged yet), or if his fix got merged there is still a remaining problem. b) It should not be possible to open /dev/ttyS3 if the device is not initialized. What is the output of 'cat /proc/tty/driver/serial' on this machine? Do you see any messages from the serial driver in the boot log? Unfortunately there are so many different ways to probe devices in the 8250 driver that I don't know where this comes from. Your config file has CONFIG_SERIAL_8250_PNP=y CONFIG_SERIAL_8250_NR_UARTS=32 CONFIG_SERIAL_8250_RUNTIME_UARTS=4 CONFIG_SERIAL_8250_EXTENDED=y I guess it's probably the preconfigured uarts that somehow become probed without initialization, but it could also be an explicit device incorrectly described by qemu. Arnd _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel