From: Thomas Gleixner <tglx@linutronix.de>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Ingo Molnar <mingo@kernel.org>, "H. Peter Anvin" <hpa@zytor.com>,
"x86@kernel.org" <x86@kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
Andrey Ryabinin <ryabinin.a.a@gmail.com>,
Konstantin Khlebnikov <koct9i@gmail.com>,
syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Sasha Levin <sasha.levin@oracle.com>,
linux-mm@kvack.org, Peter Zijlstra <peterz@infradead.org>
Subject: Re: x86: bad pte in pageattr_test
Date: Thu, 9 Jun 2016 23:34:19 +0200 (CEST) [thread overview]
Message-ID: <alpine.DEB.2.11.1606092240030.28031@nanos> (raw)
In-Reply-To: <CACT4Y+b8f7=ZnvXnzP17nDwa_jvDeTTQY_Wy7wsiohRssDULhQ@mail.gmail.com>
On Tue, 7 Jun 2016, Dmitry Vyukov wrote:
> >> I've got the following WARNING while running syzkaller fuzzer:
> >>
> >> CPA ffff880054118000: bad pte after revert 8000000054118363
>
> > CPA ffff880059990000: bad pte 8000000059990060
In both cases the PTE bit which the test modifies is in the wrong state.
> Should we delete this test if it is not important?
No. There is something badly wrong.
PAGE_BIT_CPA_TEST is the same as PAGE_BIT_SPECIAL. And the latter is used by
the mm code to mark user space mappings. The test code only modifies the
direct mapping, i.e. the kernel side one.
So something sets PAGE_BIT_SPECIAL on a kernel PTE. And that's definitely a
bug.
These are the last entries from your syzkaller log file of the first incident:
r0 = perf_event_open(&(0x7f000000f000-0x78)={0x2, 0x78, 0x11, 0x7, 0xd537, 0x6, 0x0, 0xc1, 0xffff, 0x5, 0x0, 0x40, 0x4, 0x9, 0x5369, 0x8, 0x7, 0x8508, 0x3, 0x80, 0x0}, 0x0, 0xffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000cbb000)=nil, (0x1000), 0x3, 0x32, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000cbb000)="2f6465762f696e7075742f6d6f7573652300", 0x100, 0xa00)
mmap(&(0x7f0000cbc000)=nil, (0x1000), 0x3, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000cbc000)=0x5, 0x2)
mmap(&(0x7f0000cbb000)=nil, (0x1000), 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000cbc000-0x942)=nil)
r2 = fcntl$dupfd(r0, 0x406, r0)
mmap(&(0x7f0000cbc000)=nil, (0x1000), 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f00002bf000)=nil, (0x1000), 0x3, 0x8010, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000)=nil, (0x0), 0x3, 0x32, 0xffffffffffffffff, 0x0)
pwritev(r2, &(0x7f00007e9000)=[{&(0x7f0000cbc000)=....
Do you have log of the second one available as well?
CC'ing mm and perf folks.
Thanks,
tglx
next prev parent reply other threads:[~2016-06-09 21:36 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-11 8:28 x86: bad pte in pageattr_test Dmitry Vyukov
2016-04-11 8:52 ` Andrey Ryabinin
2016-04-11 9:03 ` Dmitry Vyukov
2016-04-11 9:32 ` Andrey Ryabinin
2016-04-11 9:47 ` Dmitry Vyukov
2016-06-07 9:34 ` Dmitry Vyukov
2016-06-07 9:34 ` Dmitry Vyukov
2016-06-09 21:34 ` Thomas Gleixner [this message]
2016-06-10 10:18 ` Dmitry Vyukov
2016-06-10 12:54 ` Thomas Gleixner
2016-06-10 13:06 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.11.1606092240030.28031@nanos \
--to=tglx@linutronix.de \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=hpa@zytor.com \
--cc=kcc@google.com \
--cc=koct9i@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=ryabinin.a.a@gmail.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).