Received: by 2002:a25:ef43:0:0:0:0:0 with SMTP id w3csp653227ybm; Fri, 29 May 2020 08:59:59 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx5Rw3aS2aoEETIKMuqTxuoiI96LNoRqei4Erei8k7D1zi2yq9s5we1ldNwI5z4DF6UUKPv X-Received: by 2002:a17:906:2343:: with SMTP id m3mr8055543eja.301.1590767999324; Fri, 29 May 2020 08:59:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1590767999; cv=none; d=google.com; s=arc-20160816; b=GrOcHViQPbrDi8p7XHWxvJBUO7dBgOwLDfis456KyFL06Z/7ZjmESDvtBwEXoX5+1v U5NMpot4RMPlLuCAFG3mCKm0EgdbokMv/DWecipHuwmEL14+Ib2mEGfMxBVmhe6ydXRz /qYIvmeKl91oVjAE7Yy42oyY47CShXRNM1nlf0enVTb+3Uotc+WqON4+ZgpWZOL/O2Lt dz/ZLHSzMXCb4hX8DOrMRI8gZKIWaZHB6g9D/OBcZrcRkvNuahks7GdRU8FNZjNvmlUl hBePzfPJ9pj7LAsx2n+N9MRNsNrhlmKYOknRQADhmryykP/LAhX98NoWMTIwncqsJICx nHrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:message-id:date:references :in-reply-to:subject:cc:to:from; bh=EC0ud7bHZp0vEktqsRzyAMTZu0o/T/2Z7KDtguJETD4=; b=TDNxjVA/M9NRPF8pHdBswgvg+q14Sg+HjTwm6tZzsJT1SDlAHpClHdWFY6tBoDCbor jPlBwxMmZnryOHeGIIjwNwA+Agzlm4j2N1BURW7jZYsfRI8DPFmmEyRig/aMfQghggQH tzMjgy0Uec0kO2vXJtii1MgfxJRIlsw3OBszI6DR7beI9jC3m3rIe855bco5NZsX5Sm9 92DKg70F6F8Eba3Rn586gr/E4G6wqzJHAGQcpoRbI0EesbVVEoMw6UEGQB5QuZS4UgkB naU3vnmkrVEl1y56HsOM60KFrzs09+jOFz5DQHNJOcbLOOASAfQ1jMizxuppUXWYrjSJ kugg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id i23si5530513edx.80.2020.05.29.08.59.35; Fri, 29 May 2020 08:59:59 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727871AbgE2P5S (ORCPT + 99 others); Fri, 29 May 2020 11:57:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54330 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726962AbgE2P5R (ORCPT ); Fri, 29 May 2020 11:57:17 -0400 Received: from Galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5443FC03E969 for ; Fri, 29 May 2020 08:57:17 -0700 (PDT) Received: from p5de0bf0b.dip0.t-ipconnect.de ([93.224.191.11] helo=nanos.tec.linutronix.de) by Galois.linutronix.de with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1jehNf-0000Rq-Fi; Fri, 29 May 2020 17:57:11 +0200 Received: by nanos.tec.linutronix.de (Postfix, from userid 1000) id AC05D100F1A; Fri, 29 May 2020 17:57:10 +0200 (CEST) From: Thomas Gleixner To: Dmitry Vyukov , syzbot Cc: LKML , syzkaller-bugs , Ingo Molnar , Borislav Petkov , the arch/x86 maintainers , Oleg Nesterov Subject: Re: PANIC: double fault in fixup_bad_iret In-Reply-To: References: <000000000000d2474c05a6c938fe@google.com> Date: Fri, 29 May 2020 17:57:10 +0200 Message-ID: <87o8q6n38p.fsf@nanos.tec.linutronix.de> MIME-Version: 1.0 Content-Type: text/plain X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Dmitry, Dmitry Vyukov writes: > On Fri, May 29, 2020 at 3:14 PM syzbot > wrote: >> >> Hello, >> >> syzbot found the following crash on: >> >> HEAD commit: 7b4cb0a4 Add linux-next specific files for 20200525 >> git tree: linux-next >> console output: https://syzkaller.appspot.com/x/log.txt?x=15dc34ba100000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=47b0740d89299c10 >> dashboard link: https://syzkaller.appspot.com/bug?extid=dc1fa714cb070b184db5 >> compiler: gcc (GCC) 9.0.0 20181231 (experimental) >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14678626100000 >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1017ef06100000 >> >> IMPORTANT: if you fix the bug, please add the following tag to the commit: >> Reported-by: syzbot+dc1fa714cb070b184db5@syzkaller.appspotmail.com > > From the reproducer it seems to be either x86 related or ptrace > related. > >> RIP: 0010:fixup_bad_iret+0x24/0x170 arch/x86/kernel/traps.c:665 as a quick assumption that's related to KASAN in fixup_bad_iret() which is a frightenly bad idea. I'm about to verify. Thanks, tglx