Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753309AbaFMPOY (ORCPT ); Fri, 13 Jun 2014 11:14:24 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:17534 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752974AbaFMPOV (ORCPT ); Fri, 13 Jun 2014 11:14:21 -0400 Message-ID: <539B152A.5030801@oracle.com> Date: Fri, 13 Jun 2014 11:13:46 -0400 From: Sasha Levin User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: Dave Jones , Dan Aloni , "linux-mm@kvack.org" , Andrew Morton , Ingo Molnar , Peter Zijlstra , LKML , "netdev@vger.kernel.org" Subject: Re: mm/sched/net: BUG when running simple code References: <539A6850.4090408@oracle.com> <20140613032754.GA20729@gmail.com> <539A77A1.60700@oracle.com> <20140613041331.GA31688@redhat.com> In-Reply-To: <20140613041331.GA31688@redhat.com> X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 06/13/2014 12:13 AM, Dave Jones wrote: > On Fri, Jun 13, 2014 at 12:01:37AM -0400, Sasha Levin wrote: > > On 06/12/2014 11:27 PM, Dan Aloni wrote: > > > On Thu, Jun 12, 2014 at 10:56:16PM -0400, Sasha Levin wrote: > > >> > Hi all, > > >> > > > >> > Okay, I'm really lost. I got the following when fuzzing, and can't really explain what's > > >> > going on. It seems that we get a "unable to handle kernel paging request" when running > > >> > rather simple code, and I can't figure out how it would cause it. > > > [..] > > >> > Which agrees with the trace I got: > > >> > > > >> > [ 516.309720] BUG: unable to handle kernel paging request at ffffffffa0f12560 > > >> > [ 516.309720] IP: netlink_getsockopt (net/netlink/af_netlink.c:2271) > > > [..] > > >> > [ 516.309720] RIP netlink_getsockopt (net/netlink/af_netlink.c:2271) > > >> > [ 516.309720] RSP > > >> > [ 516.309720] CR2: ffffffffa0f12560 > > >> > > > >> > They only theory I had so far is that netlink is a module, and has gone away while the code > > >> > was executing, but netlink isn't a module on my kernel. > > > The RIP - 0xffffffffa0f12560 is in the range (from Documentation/x86/x86_64/mm.txt): > > > > > > ffffffffa0000000 - ffffffffff5fffff (=1525 MB) module mapping space > > > > > > So seems it was in a module. > > > > Yup, that's why that theory came up, but when I checked my config: > > ... > > that theory went away. (also confirmed by not finding a netlink module.) > > > > What about the kernel .text overflowing into the modules space? The loader > > checks for that, but can something like that happen after everything is > > up and running? I'll look into that tomorrow. > > another theory: Trinity can sometimes generate plausible looking module > addresses and pass those in structs etc. > > I wonder if there's somewhere in that path that isn't checking that the address > in the optval it got is actually a userspace address before it tries to write to it. This is, the access happened way before touching optval. The only thing that happened before is reading optlen from userspace, but that happened using get_user() which should mean that it was safe. According to that trace, we died when *executing* a piece of code, not when accessing some other memory. None of the instructions around the instruction we failed on don't touch memory at all for that matter. Thanks, Sasha -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/