From: Andrey Konovalov <andreyknvl@google.com>
To: Dmitry Vyukov <dvyukov@google.com>, Will Deacon <will@kernel.org>
Cc: syzbot <syzbot+45b6fce29ff97069e2c5@syzkaller.appspotmail.com>,
Dave Martin <Dave.Martin@arm.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Linux ARM <linux-arm-kernel@lists.infradead.org>,
LKML <linux-kernel@vger.kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: Re: WARNING in __do_kernel_fault
Date: Wed, 27 Jan 2021 20:56:24 +0100 [thread overview]
Message-ID: <CAAeHK+wDz8aSLyjq1b=q3+HG9aJXxwYR6+gN_fTttMN5osM5gg@mail.gmail.com> (raw)
In-Reply-To: <CACT4Y+Y=4yYf1qXxRkNdxHfZU89sRMxwT9JN8_irwGK8mTsZLw@mail.gmail.com>
On Wed, Jan 27, 2021 at 8:43 PM Dmitry Vyukov <dvyukov@google.com> wrote:
> > > > > > > This happens on arm64 instance with mte enabled.
> > > > > > > There is a GPF in reiserfs_xattr_init on x86_64 reported:
> > > > > > > https://syzkaller.appspot.com/bug?id=8abaedbdeb32c861dc5340544284167dd0e46cde
> > > > > > > so I would assume it's just a plain NULL deref. Is this WARNING not
> > > > > > > indicative of a kernel bug? Or there is something special about this
> > > > > > > particular NULL deref?
> > > > > >
> > > > > > Congratulations, you're the first person to trigger this warning!
> > > > > >
> > > > > > This fires if we take an unexpected data abort in the kernel but when we
> > > > > > get into the fault handler the page-table looks ok (according to the CPU via
> > > > > > an 'AT' instruction). Are you using QEMU system emulation? Perhaps its
> > > > > > handling of AT isn't quite right.
> > > > >
> > > > > Hi Will,
> > > > >
> > > > > Yes, it's qemu-system-aarch64 5.2 with -machine virt,mte=on -cpu max.
> > > > > Do you see any way forward for this issue? Can somehow prove/disprove
> > > > > it's qemu at fault?
> > > >
> > > > I've reproduced this crash (by taking [1] and changing
> > > > sys_memfd_create to 279), but it manifests as a normal null-ptr-deref
> > > > for me. I'm using the latest QEMU master. Which QEMU does syzbot use
> > > > exactly?
> > >
> > > qemu-system-aarch64 5.2 from this container:
> > > https://github.com/google/syzkaller/blob/master/tools/docker/syzbot/Dockerfile
> > > you can get a prebuilt version with:
> > > docker pull gcr.io/syzkaller/syzbot
> >
> > Reproduced with this QEMU, still a normal null-ptr-deref. Where do I
> > find the full list of arguments that are passed to QEMU on syzbot?
>
> I am yet to document all details of these new instances, but the
> syzkaller config contains:
> "qemu_args": "-machine
> virt,virtualization=on,mte=on,graphics=on,usb=on -cpu max"
> the rest are in vm/qemu/qemu.go
OK, the virtualization=on part is what causes this. Bug in QEMU?
prev parent reply other threads:[~2021-01-27 19:57 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-27 16:56 WARNING in __do_kernel_fault syzbot
2021-01-27 17:00 ` Dmitry Vyukov
2021-01-27 17:14 ` Will Deacon
2021-01-27 17:24 ` Dmitry Vyukov
2021-01-27 17:34 ` Will Deacon
2021-03-12 10:56 ` Dmitry Vyukov
2021-01-27 18:46 ` Andrey Konovalov
2021-01-27 18:56 ` Dmitry Vyukov
2021-01-27 19:16 ` Andrey Konovalov
2021-01-27 19:43 ` Dmitry Vyukov
2021-01-27 19:56 ` Andrey Konovalov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAAeHK+wDz8aSLyjq1b=q3+HG9aJXxwYR6+gN_fTttMN5osM5gg@mail.gmail.com' \
--to=andreyknvl@google.com \
--cc=Dave.Martin@arm.com \
--cc=catalin.marinas@arm.com \
--cc=dvyukov@google.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=syzbot+45b6fce29ff97069e2c5@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).