linux-kernel - Re: Bad page state splats on arm64, v4.11-rc{3,4}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Apr 2017 12:37:51 +0100
From:   Will Deacon <will.deacon@....com>
To:     Mark Rutland <mark.rutland@....com>
Cc:     linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-mm@...ck.org, catalin.marinas@....com, punit.agrawal@....com
Subject: Re: Bad page state splats on arm64, v4.11-rc{3,4}

On Mon, Apr 03, 2017 at 11:56:29AM +0100, Mark Rutland wrote:
> On Fri, Mar 31, 2017 at 06:58:45PM +0100, Mark Rutland wrote:
> > Hi,
> > 
> > I'm seeing intermittent bad page state splats on arm64 with 4.11-rc3 and
> > v4.11-rc4. I have not tested earlier kernels, or other architectures.
> > 
> > So far, it looks like the flags are always bad in the same
> > way:
> > 
> > 	bad because of flags: 0x80(waiters)
> > 
> > ... though I don't know if that's definitely the case for splat 4, the
> > BUG at mm/page_alloc.c:800.
> > 
> > I see this in QEMU VMs launched by Syzkaller, triggering once every few
> > hours. So far, I have not been able to reproduce the issue in any other
> > way (including using syz-repro).
> 
> It looks like this may be an issue with the arm64 HUGETLB code.
> 
> I wasn't able to trigger the issue over the weekend on a kernel with
> HUGETLBFS disabled. There are known issues with our handling of
> contiguous entries, and this might be an artefact of that.

After chatting with Punit, it looks like this might be because the GUP
code doesn't handle huge ptes (which we create using the contiguous hint),
so follow_page_pte ends up with one of those and goes wrong. In particular,
the migration code will certainly do the wrong thing.

I'll probably revert the contiguous support (again) if testing indicates
that it makes this issue disappear.

Will