On 11/18/2016 11:19 AM, Dmitry Vyukov wrote:
Hello,
I've got the following BUG while running syzkaller on
a25f0944ba9b1d8a6813fd6f1a86f1bd59ac25a6 (4.9-rc5). Unfortunately it's
not reproducible.
kernel BUG at ./include/linux/mm.h:1743!
invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
Shouldn't there be also dump_page() output? Since you've hit this:
VM_BUG_ON_PAGE(page->pmd_huge_pte, page);
Anyway the output wouldn't contain the value of pmd_huge_pte or stuff
that's in union with it. I'd suggest adding a local patch that prints
this in the error case, in case the fuzzer hits it again.
Heck, it might even make sense to print raw contents of struct page in
dump_page() as a catch-all solution? Should I send a patch?
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 3 PID: 4049 Comm: syz-fuzzer Not tainted 4.9.0-rc5+ #43
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006ad028c0 task.stack: ffff8800667e0000
RIP: 0010:[<ffffffff8130e2ab>] [< inline >]
pgtable_pmd_page_dtor include/linux/mm.h:1743
RIP: 0010:[<ffffffff8130e2ab>] [<ffffffff8130e2ab>]
___pmd_free_tlb+0x3db/0x5a0 arch/x86/mm/pgtable.c:74
RSP: 0018:ffff8800667e6908 EFLAGS: 00010292
RAX: 0000000000000000 RBX: 1ffff1000ccfcd25 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffed000ccfcd10
RBP: ffff8800667e6a70 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: 0000000000000001 R12: ffff8800667e6ef8
R13: ffff8800667e6a48 R14: ffffea0000e196c0 R15: 000000000003865b
FS: 00007f152a530700(0000) GS:ffff88006d100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1514bff9d0 CR3: 0000000009821000 CR4: 00000000000006e0
DR0: 0000000000000400 DR1: 0000000000000400 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Stack:
0000000000000000 ffff88006ad030e0 ffff88006ad030b8 dffffc0000000000
0000000041b58ab3 ffffffff894db568 ffffffff8130ded0 ffffffff8156b2a0
0000000000000082 ffff88006ad030e0 1ffff1000ccfcd30 1ffff1000ccfcd38
Call Trace:
[< inline >] __pmd_free_tlb arch/x86/include/asm/pgalloc.h:110
[< inline >] free_pmd_range mm/memory.c:443
[< inline >] free_pud_range mm/memory.c:461
[<ffffffff81946458>] free_pgd_range+0xb98/0x1270 mm/memory.c:537
[<ffffffff81946da5>] free_pgtables+0x275/0x340 mm/memory.c:569
[<ffffffff81972761>] exit_mmap+0x281/0x4e0 mm/mmap.c:2942
[< inline >] __mmput kernel/fork.c:866
[<ffffffff813f24ce>] mmput+0x20e/0x4c0 kernel/fork.c:888
[< inline >] exit_mm kernel/exit.c:512
[<ffffffff814119a0>] do_exit+0x960/0x2640 kernel/exit.c:815
[<ffffffff8141383e>] do_group_exit+0x14e/0x420 kernel/exit.c:931
[<ffffffff814429d3>] get_signal+0x663/0x1880 kernel/signal.c:2307
[<ffffffff81239b45>] do_signal+0xc5/0x2190 arch/x86/kernel/signal.c:807
[<ffffffff8100666a>] exit_to_usermode_loop+0x1ea/0x2d0
arch/x86/entry/common.c:156
[< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190
[<ffffffff81009693>] syscall_return_slowpath+0x4d3/0x570
arch/x86/entry/common.c:259
[<ffffffff881479a6>] entry_SYSCALL_64_fastpath+0xc4/0xc6
Code: 10 00 00 4c 89 e7 e8 25 6c 63 00 e9 9b fd ff ff e8 0b 9e 3d 00
0f 0b e8 04 9e 3d 00 48 c7 c6 00 ac 27 88 4c 89 f7 e8 85 9e 62 00 <0f>
0b e8 9e 2d 6e 00 e9 1a fe ff ff 48 89 cf 48 89 8d b0 fe ff
RIP [< inline >] pgtable_pmd_page_dtor include/linux/mm.h:1743
RIP [<ffffffff8130e2ab>] ___pmd_free_tlb+0x3db/0x5a0 arch/x86/mm/pgtable.c:74
RSP <ffff8800667e6908>
---[ end trace 4ef4b70d88f62f8a ]---
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>