Received-SPF: pass (google.com: domain of linux-kernel+bounces-153521-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Mon, 22 Apr 2024 10:13:17 -0400
From: "Liam R. Howlett" <Liam.Howlett@oracle.com>
To: Marius Fleischer <fleischermarius@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>, maple-tree@lists.infradead.org,
        linux-kernel@vger.kernel.org, syzkaller@googlegroups.com,
        harrisonmichaelgreen@gmail.com
Subject: Re: general protection fault in mas_empty_area_rev
Message-ID: <uekqafv4wx5axijnnfybnxixui3ruzy3mkxirflv7tb3ovrtbk@ounqurycykuv>
References: <CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com>
User-Agent: NeoMutt/20231103
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?h+TZK9Di5qVhPD2fSO7x37hywsvGi7VAucKr0rrOMjL+HlTtJaXYYE4utCsT?=
 =?us-ascii?Q?LLZeo+TgXMD0P3t56rXino8IxPXfp8zQZvhzZ3f7isD2DK4Tya8iIb9MoIcw?=
 =?us-ascii?Q?51DD3RnpIM1JKpwtybOwZMG+itzOx0UV+IlfbDiZ+IwOKZdlFJv2giVuNBQG?=
 =?us-ascii?Q?p7LUZQhD4ZJs8qs5n0eFDugT2qbZJBFXydVL6RQy0aIH5MRod8r4bCtYugaI?=
 =?us-ascii?Q?7rHSJ8kZ1px96ZHriUtU2razPAFW0FIyOAvdcOxSPBDDOy+B+XHmAjxyCn4c?=
 =?us-ascii?Q?dGtoLSztT7ZTRjOmoJ2VfkmW4ZSbY8ga+1uW/wSeYo6g4BbSIznNzyXV4vxf?=
 =?us-ascii?Q?HFPmMiKbgu9DPDU0c9phh4v+cONX1C8X9iXDEQQkVMfBQYch8QnDFN0qCYir?=
 =?us-ascii?Q?s/ZhaIq3dCUqYxfRy7WoQ3w+qaunZN6clOt5bxjnWWyc5HgX9dvXCcYpsomh?=
 =?us-ascii?Q?lifgLikot8sJgnRFtoZBy3zuheCBU1GJQnonNvWgFx4wXLqC4BC6PyeWHTpp?=
 =?us-ascii?Q?119ZqyKxuA44jMiasOCN13bxfP9oY7GVG3nNV4Zg113ixUMXBrvHINAMfZME?=
 =?us-ascii?Q?2w61ZqCr9cRn3xxblNoLs121QblHEjvcwqmhzByqRyqQnIzX1jRQF95scjpd?=
 =?us-ascii?Q?JZS7yHmFy0TDc69fS5ISsaueu4JudcvQh32821VgNXzckYg+9ZdWydK0ayvk?=
 =?us-ascii?Q?9/njQjsQOvQX+GSjPwo/KBMW2ysVeCJgdYPrMRGyznZFchrleeA0xbE8WOck?=
 =?us-ascii?Q?h2HfDkfBip33gSAF6Uu2BVIYynNVracNRKNWKvaIWk4mkix3zPlBmSepdfjq?=
 =?us-ascii?Q?aLokfqiRA/B08ASCL9XeAAypBgynYG8wYhuXo//voB5Gh6qdWMHYQPiYXV3E?=
 =?us-ascii?Q?Z1PSUokJiAJj2wOrzL1apBylW0xUITqkQPbJTl4WfCVRyZf79hbhnxF/AX9s?=
 =?us-ascii?Q?uSggH5io6g9RKg2F5YdvCeTeNlodCBGd7CRH58odwEOgRT1AJqeyZJsILGAA?=
 =?us-ascii?Q?lA3QMCtTeezYIxUiWmdawG+S6RJi8po8PjEFLkqjAD1FFl0RgfEh96iG4uX5?=
 =?us-ascii?Q?DMDTVdpKNfVPDlJIsR514h8eli1ee86mi6Sx2mpkK20MPRspB73KwYQbcO3H?=
 =?us-ascii?Q?+UY8FVG6htuWcfOmZDMXJoUPQ9wcXyx1AM0HBuyEV0QTaO/tW8MWBEwEprCN?=
 =?us-ascii?Q?RA+HyHvK0ripb+BW6Qnp+3Db0by+Pkr/FHBY7eEvFLaG0mEss+6PP5/52G9Z?=
 =?us-ascii?Q?+PVrd1HowMIdBI5WZuxZus+rQoYgw3FT2Zql1LmJoqhpw8moBMbDKEtKpvH2?=
 =?us-ascii?Q?MghR7ZNm5nU8Jg5yK+cJehA9CLmfEteIjVKTim34xBELwm9w0XXDm3TWuLmT?=
 =?us-ascii?Q?D/ZcM5DFZ+Tbefa+0535c1dJk/UZHgRf36sfO2U+NTeqFlGwqm+fBf05/9K+?=
 =?us-ascii?Q?U/cbyLA6picPXtZCDPR9STbUM4xJFZIZTBJbOSZJ0CBDvkSq3bZstVj3A6y8?=
 =?us-ascii?Q?cTKUNcEQm3pnUzqCDWrx3oBqC0fafYZPPaQE5zN+WOZPBJnTKLMhDrvR/JZF?=
 =?us-ascii?Q?sYbJoBAELWjE8hT1LK/v235Y3vNioFGDsowgASxT?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	41Ou40RydcbQo//RvvSsmxpkJTmo6xQU9GLyVPH8AhgQ55RaYef6yzoemWOSeZGVtekmSkdBy0+LWkHOxQHp/kQC4PjzG8Ap1lwayqmRkSU7Vi+VDxpLLca4eYcGP1NlcWKq67GQ1k8t1yWsOCgTx1AZSXRVvYTSQb02nt+WCIVGQFvXb5G/+eu++HAuWEwUDH6UUndU53o8yPBxbrwEXNzEXF2yhu73Qsz+SrcCaKzPRbvU3qBbKrZ7cvsVia/44czi+cVWSPQpPglAlw0/tKwvn0kaWunBi408moImgmWGd2vXRkGGcqzU7F8gN9dHU1LpmBIgtOPqNzWL7w+YXesnM4EWQp2TKBf8KMwnMnoZWzZI1ckJCfNzfzQuoHKgtqLLjuDWa+H3xXUKa1+65k17BKWVd+SVeIJpKxwUSbpTyom467xWuc0NnQDrf5rZtgq9SvOIe447JZboqRrkWjjy8bfrRI2V7q2jpvfT7mtsRQpnjmt56Pp2tUPayczHsn2D8mJetlzuQjfPkeZA8k0Gr574DbuZuJu1cM4cX0r1teiFO2Sv4ZYbsXZgAxe+Igjb3mvZFxXGhsacejkqTFsTgy76MEw/k2ZN4Z3a5Vk=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e81d9a84-9852-4fb4-c3ce-08dc62d65cf5
X-MS-Exchange-CrossTenant-AuthSource: DS0PR10MB7933.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2024 14:13:20.3150
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 8pW9ykJuRG/ys4q+pwmvmNrtoht9hMBnFl/v7cwRwLnKacE4YhgUGe/7mM4KoRETuC8XYhoDpNeD8WYHF8ynCg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB7033
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-04-22_09,2024-04-22_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 suspectscore=0 mlxscore=0
 mlxlogscore=758 bulkscore=0 malwarescore=0 spamscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2404010000
 definitions=main-2404220062
X-Proofpoint-ORIG-GUID: YfFhn-oLbzqsNYlcf4cw4DmStkdC15OG
X-Proofpoint-GUID: YfFhn-oLbzqsNYlcf4cw4DmStkdC15OG

* Marius Fleischer <fleischermarius@gmail.com> [240420 16:08]:
> Hi,
> 
> 
> We would like to report the following bug which has been found by our
> modified version of syzkaller.
> 
> ======================================================
> 
> description: general protection fault in mas_empty_area_rev
> 
> affected file: lib/maple_tree.c
> 
> kernel version: 6.9-rc4
> 
> kernel commit: 0bbac3facb5d6cc0171c45c9873a2dc96bea9680
> 
> git tree: upstream
> 
> kernel config: attached
> 
> crash reproducer: attached
> 
> ======================================================


Thank you for reporting this issue.  I'm currently looking at what went
wrong.

It does not occur with my configuration against the reported kernel
version.  I'll attempt to recreate it with your kernel config next -
with whatever modifications I need to get it to boot in my test
environment.

> 
> Crash log:
> 
> general protection fault, probably for non-canonical address
> 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
> 
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> 
> CPU: 0 PID: 79545 Comm: syz-executor.0 Not tainted 6.9.0-rc4-dirty #3

This indicates that you built with your own patches.  Could you test an
unmodified 6.9.0-rc4 with your setup?

Thanks,
Liam

> 
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1
> 04/01/2014
> 
> RIP: 0010:ma_dead_node lib/maple_tree.c:560 [inline]
> 
> RIP: 0010:mas_data_end lib/maple_tree.c:1450 [inline]
> 
> RIP: 0010:mas_empty_area_rev+0x15ad/0x2320 lib/maple_tree.c:5114
> 
..

> Call Trace:
> 
>  <TASK>
> 
>  unmapped_area_topdown mm/mmap.c:1643 [inline]
> 
>  vm_unmapped_area+0x2db/0xb30 mm/mmap.c:1682
> 
>  arch_get_unmapped_area_topdown+0x384/0x750 arch/x86/kernel/sys_x86_64.c:212
> 
>  thp_get_unmapped_area mm/huge_memory.c:864 [inline]
> 
>  thp_get_unmapped_area+0x361/0x430 mm/huge_memory.c:854
> 
>  get_unmapped_area+0x1db/0x3e0 mm/mmap.c:1845
> 
>  do_mmap+0x282/0xef0 mm/mmap.c:1261
> 
>  vm_mmap_pgoff+0x1a7/0x3b0 mm/util.c:573
..