Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Daniel Axtens <dja@axtens.net>
To:     Brian Foster <bfoster@redhat.com>
Cc:     syzbot <syzbot+4722bf4c6393b73a792b@syzkaller.appspotmail.com>,
        akpm@linux-foundation.org, allison.henderson@oracle.com,
        aryabinin@virtuozzo.com, darrick.wong@oracle.com,
        dchinner@redhat.com, dvyukov@google.com,
        linux-kernel@vger.kernel.org, linux-xfs@vger.kernel.org,
        sandeen@redhat.com, syzkaller-bugs@googlegroups.com,
        torvalds@linux-foundation.org
Subject: Re: BUG: unable to handle kernel paging request in xfs_sb_quiet_read_verify
In-Reply-To: <20191220130441.GA11941@bfoster>
References: <000000000000d99340059a100686@google.com> <874kxvttx0.fsf@dja-thinkpad.axtens.net> <20191220130441.GA11941@bfoster>
Date:   Sat, 21 Dec 2019 06:27:51 +1100
Message-ID: <87zhfmssp4.fsf@dja-thinkpad.axtens.net>
MIME-Version: 1.0
Content-Type: text/plain
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


>> > HEAD commit:    2187f215 Merge tag 'for-5.5-rc2-tag' of git://git.kernel.o..


> Since this mapping functionality is fairly fundamental code in XFS, I
> ran a quick test to use a multi-page directory block size (i.e. mkfs.xfs
> -f <dev> -nsize=8k), started populating a directory and very quickly hit
> a similar crash. I'm going to double check that this works as expected
> without KASAN vmalloc support enabled, but is it possible something is
> wrong with KASAN here?

Yes, as it turns out. xfs is using vm_map_ram, and the commit syzkaller
is testing is missing the support for vm_map_ram. Support landed in
master at d98c9e83b5e7 ("kasan: fix crashes on access to memory mapped
by vm_map_ram()") but that's _after_ 2187f215 which syzkaller was
testing

#syz fix: kasan: fix crashes on access to memory mapped by vm_map_ram()

Sorry for the noise.

Regards,
Daniel

>
> Brian
>
>> Regards,
>> Daniel
>> 
>> >
>> > bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=161240aee00000
>> > final crash:    https://syzkaller.appspot.com/x/report.txt?x=151240aee00000
>> > console output: https://syzkaller.appspot.com/x/log.txt?x=111240aee00000
>> >
>> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> > Reported-by: syzbot+4722bf4c6393b73a792b@syzkaller.appspotmail.com
>> > Fixes: 0609ae011deb ("x86/kasan: support KASAN_VMALLOC")
>> >
>> > BUG: unable to handle page fault for address: fffff52000680000
>> > #PF: supervisor read access in kernel mode
>> > #PF: error_code(0x0000) - not-present page
>> > PGD 21ffee067 P4D 21ffee067 PUD aa51c067 PMD a85e1067 PTE 0
>> > Oops: 0000 [#1] PREEMPT SMP KASAN
>> > CPU: 1 PID: 3088 Comm: kworker/1:2 Not tainted 5.5.0-rc2-syzkaller #0
>> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
>> > Google 01/01/2011
>> > Workqueue: xfs-buf/loop0 xfs_buf_ioend_work
>> > RIP: 0010:xfs_sb_quiet_read_verify+0x47/0xc0 fs/xfs/libxfs/xfs_sb.c:735
>> > Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 7f 49 8b 9c 24 30 01  
>> > 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 04 02 84  
>> > c0 74 04 3c 03 7e 50 8b 1b bf 58 46 53 42 89 de e8
>> > RSP: 0018:ffffc90008187cc0 EFLAGS: 00010a06
>> > RAX: dffffc0000000000 RBX: ffffc90003400000 RCX: ffffffff82ad3c26
>> > RDX: 1ffff92000680000 RSI: ffffffff82aa0a0f RDI: ffff8880a2cdba70
>> > RBP: ffffc90008187cd0 R08: ffff88809eb6c500 R09: ffffed1015d2703d
>> > R10: ffffed1015d2703c R11: ffff8880ae9381e3 R12: ffff8880a2cdb940
>> > R13: ffff8880a2cdb95c R14: ffff8880a2cdbb74 R15: 0000000000000000
>> > FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
>> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> > CR2: fffff52000680000 CR3: 000000009f5ab000 CR4: 00000000001406e0
>> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> > Call Trace:
>> >   xfs_buf_ioend+0x3f9/0xde0 fs/xfs/xfs_buf.c:1162
>> >   xfs_buf_ioend_work+0x19/0x20 fs/xfs/xfs_buf.c:1183
>> >   process_one_work+0x9af/0x1740 kernel/workqueue.c:2264
>> >   worker_thread+0x98/0xe40 kernel/workqueue.c:2410
>> >   kthread+0x361/0x430 kernel/kthread.c:255
>> >   ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
>> > Modules linked in:
>> > CR2: fffff52000680000
>> > ---[ end trace 744ceb50d377bf94 ]---
>> > RIP: 0010:xfs_sb_quiet_read_verify+0x47/0xc0 fs/xfs/libxfs/xfs_sb.c:735
>> > Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 7f 49 8b 9c 24 30 01  
>> > 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 04 02 84  
>> > c0 74 04 3c 03 7e 50 8b 1b bf 58 46 53 42 89 de e8
>> > RSP: 0018:ffffc90008187cc0 EFLAGS: 00010a06
>> > RAX: dffffc0000000000 RBX: ffffc90003400000 RCX: ffffffff82ad3c26
>> > RDX: 1ffff92000680000 RSI: ffffffff82aa0a0f RDI: ffff8880a2cdba70
>> > RBP: ffffc90008187cd0 R08: ffff88809eb6c500 R09: ffffed1015d2703d
>> > R10: ffffed1015d2703c R11: ffff8880ae9381e3 R12: ffff8880a2cdb940
>> > R13: ffff8880a2cdb95c R14: ffff8880a2cdbb74 R15: 0000000000000000
>> > FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
>> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> > CR2: fffff52000680000 CR3: 000000009f5ab000 CR4: 00000000001406e0
>> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> >
>> >
>> > ---
>> > This bug is generated by a bot. It may contain errors.
>> > See https://goo.gl/tpsmEJ for more information about syzbot.
>> > syzbot engineers can be reached at syzkaller@googlegroups.com.
>> >
>> > syzbot will keep track of this bug report. See:
>> > https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>> > For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>> > syzbot can test patches for this bug, for details see:
>> > https://goo.gl/tpsmEJ#testing-patches
>>