Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: TxEr8Kj0dMWMhLLIKlDjaSS4qPK087B27BYnFZWOjdjpvpI9IKiTGeZcY5r9wv5AhGFbs9VBri
 nGLDtsaQNoVA==
IronPort-SDR: Hmt0b3bWk3FGU0LKmcKgQ0wNl3GKIVKo4Fb+10Tv+bsqQf9j0sO0wYR8CZxlB27WI+ElswuQJu
 QGh6XA0w7J5Q==
From:   "Huang\, Ying" <ying.huang@intel.com>
To:     Qian Cai <cai@lca.pw>
Cc:     Linux-MM <linux-mm@kvack.org>, LKML <linux-kernel@vger.kernel.org>,
        Minchan Kim <minchan@kernel.org>,
        Hugh Dickins <hughd@google.com>,
        "Andrew Morton" <akpm@linux-foundation.org>
Subject: Re: linux-next: not-present page at swap_vma_readahead()
References: <62A0ACFC-E023-4269-8121-F96B879A8C51@lca.pw>
        <81F06AA9-F25B-4342-9CF7-2763AC394A18@lca.pw>
Date:   Wed, 15 Apr 2020 10:01:53 +0800
In-Reply-To: <81F06AA9-F25B-4342-9CF7-2763AC394A18@lca.pw> (Qian Cai's message
        of "Tue, 14 Apr 2020 17:22:54 -0400")
Message-ID: <874ktl1p7y.fsf@yhuang-dev.intel.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Qian Cai <cai@lca.pw> writes:

>> On Apr 14, 2020, at 10:32 AM, Qian Cai <cai@lca.pw> wrote:
>> 
>> Fuzzers are unhappy. Thoughts?
>
> This is rather to reproduce. All the traces so far are from copy_from_user() to trigger a page fault,
> and then it dereferences a bad pte in swap_vma_readahead(),
>
> 	for (i = 0, pte = ra_info.ptes; i < ra_info.nr_pte;
> 	     i++, pte++) {
> 		pentry = *pte;   <— crashed here.
> 		if (pte_none(pentry))

Is it possible to bisect this?

Because the crash point is identified, it may be helpful to collect and
analyze the status of the faulting page table and readahead ptes.  But I
am not familiar with the ARM64 architecture.  So I cannot help much
here.

Best Regards,
Huang, Ying