Re: kernel BUG at mm/gup.c:LINE!

From: Michal Hocko <mhocko@kernel.org>
To: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: syzbot <syzbot+5dcb560fe12aa5091c06@syzkaller.appspotmail.com>,
	akpm@linux-foundation.org, aneesh.kumar@linux.vnet.ibm.com,
	dan.j.williams@intel.com, kirill.shutemov@linux.intel.com,
	linux-mm@kvack.org, mst@redhat.com,
	syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk,
	ying.huang@intel.com, zi.yan@cs.rutgers.edu
Subject: Re: kernel BUG at mm/gup.c:LINE!
Date: Wed, 4 Jul 2018 13:17:31 +0200	[thread overview]
Message-ID: <20180704111731.GJ22503@dhcp22.suse.cz> (raw)
In-Reply-To: <da0f4abb-9401-cfac-6332-9086aadf67eb@I-love.SAKURA.ne.jp>

On Wed 04-07-18 19:01:51, Tetsuo Handa wrote:
> +Michal Hocko
> 
> On 2018/07/04 13:19, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following crash on:
> > 
> > HEAD commit:    d3bc0e67f852 Merge tag 'for-4.18-rc2-tag' of git://git.ker..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1000077c400000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=a63be0c83e84d370
> > dashboard link: https://syzkaller.appspot.com/bug?extid=5dcb560fe12aa5091c06
> > compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
> > userspace arch: i386
> > syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=158577a2400000
> 
> Here is C reproducer made from syz reproducer. mlockall(MCL_FUTURE) is involved.
> 
> This problem is triggerable by an unprivileged user.
> Shows different result on x86_64 (crash) and x86_32 (stall).
> 
> ------------------------------------------------------------
> /* Need to compile using "-m32" option if host is 64bit. */
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> #include <unistd.h>
> #include <sys/mman.h>
> int uselib(const char *library);
> 
> int main(int argc, char *argv[])
> {
> 	int fd = open("file", O_WRONLY | O_CREAT, 0644);
> 	write(fd, "\x7f\x45\x4c\x46\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02"
> 	      "\x00\x06\x00\xca\x3f\x8b\xca\x00\x00\x00\x00\x38\x00\x00\x00\x00\x00"
> 	      "\x00\xf7\xff\xff\xff\xff\xff\xff\x1f\x00\x02\x00\x00\x00\x00\x00\x00"
> 	      "\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf8\x7b"
> 	      "\x66\xff\x00\x00\x05\x00\x00\x00\x76\x86\x00\x00\x00\x00\x00\x00\x00"
> 	      "\x00\x00\x00\x31\x0f\xf3\xee\xc1\xb0\x00\x0c\x08\x53\x55\xbe\x88\x47"
> 	      "\xc2\x2e\x30\xf5\x62\x82\xc6\x2c\x95\x72\x3f\x06\x8f\xe4\x2d\x27\x96"
> 	      "\xcc", 120);
> 	fchmod(fd, 0755);
> 	close(fd);
> 	mlockall(MCL_FUTURE); /* Removing this line avoids the bug. */
> 	uselib("file");
> 	return 0;
> }
> ------------------------------------------------------------
> 
> ------------------------------------------------------------
> CentOS Linux 7 (Core)
> Kernel 4.18.0-rc3 on an x86_64
> 
> localhost login: [   81.210241] emacs (9634) used greatest stack depth: 10416 bytes left
> [  140.099935] ------------[ cut here ]------------
> [  140.101904] kernel BUG at mm/gup.c:1242!

Is this 
	VM_BUG_ON(len != PAGE_ALIGN(len));
in __mm_populate? I do not really get why we should VM_BUG_ON when the
len is not page aligned to be honest. The library is probably containing
some funky setup but if we simply cannot round up to the next PAGE_SIZE
boundary then we should probably just error out and fail. This is an
area I am really familiar with so I cannot really judge.
-- 
Michal Hocko
SUSE Labs