| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+Z9UDZNLsoEz-DO3fX_+0gTwPUA=uE++J=w1sAG_4CGJg@mail.gmail.com>
Date: Thu, 28 Jan 2016 11:27:11 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: Vlastimil Babka <vbabka@...e.cz>,
"Kirill A. Shutemov" <kirill@...temov.name>,
Doug Gilbert <dgilbert@...erlog.com>,
Andrew Morton <akpm@...ux-foundation.org>,
David Rientjes <rientjes@...gle.com>,
Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
Shiraz Hashim <shashim@...eaurora.org>,
"linux-mm@...ck.org" <linux-mm@...ck.org>,
LKML <linux-kernel@...r.kernel.org>,
Hugh Dickins <hughd@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>,
syzkaller <syzkaller@...glegroups.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
linux-scsi <linux-scsi@...r.kernel.org>
Subject: mm: another VM_BUG_ON_PAGE(PageTail(page))
Hello,
The following program triggers VM_BUG_ON_PAGE(PageTail(page)):
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <fcntl.h>
#include <numaif.h>
#include <sys/mman.h>
#include <unistd.h>
int main()
{
int fd;
mmap((void*)0x20000000, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0);
fd = open("/dev/sg1", O_RDONLY|O_SYNC|0x100000);
mmap((void*)0x20001000, 0x4000, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED, fd, 0);
mbind((void*)0x20000000, 0x4000, 0x8002, (void*)0x20002ff8, 3660,
MPOL_MF_STRICT|MPOL_MF_MOVE);
return 0;
}
page:ffffea0000f5da80 count:0 mapcount:1 mapping:dead000000000400
index:0x0 compound_mapcount: 0
flags: 0x1fffc0000000000()
page dumped because: VM_BUG_ON_PAGE(PageTail(page))
------------[ cut here ]------------
kernel BUG at mm/vmscan.c:1446!
invalid opcode: 0000 [#27] SMP DEBUG_PAGEALLOC KASAN
Modules linked in:
CPU: 1 PID: 8185 Comm: a.out Tainted: G D 4.5.0-rc1+ #300
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006146c740 ti: ffff88006c8f0000 task.ti: ffff88006c8f0000
RIP: 0010:[<ffffffff8169309a>] [<ffffffff8169309a>]
isolate_lru_page+0x4ea/0x6d0
RSP: 0018:ffff88006c8f7a50 EFLAGS: 00010282
RAX: ffff88006146c740 RBX: ffffea0000f5da80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffea0000f5dab8
RBP: ffff88006c8f7a88 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000002 R11: 1ffffffff134edc5 R12: ffffea0000f5daa0
R13: ffffea0000f5da00 R14: ffffea0000f5da01 R15: 0000000020004000
FS: 00000000022ec880(0063) GS:ffff88003ed00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000020003000 CR3: 0000000031d0b000 CR4: 00000000000006e0
Stack:
00000001ffffffff ffffffff816e4159 ffff8800310f6018 0000000020003000
dffffc0000000000 ffffea0000f5da80 0000000020004000 ffff88006c8f7b10
ffffffff8174efdd ffffea0000000001 ffff88006c8f7c70 ffff88006c8f7de8
Call Trace:
[< inline >] migrate_page_add mm/mempolicy.c:966
[<ffffffff8174efdd>] queue_pages_pte_range+0x4ad/0x10b0 mm/mempolicy.c:552
[< inline >] walk_pmd_range mm/pagewalk.c:50
[< inline >] walk_pud_range mm/pagewalk.c:90
[< inline >] walk_pgd_range mm/pagewalk.c:116
[<ffffffff817209c3>] __walk_page_range+0x653/0xcd0 mm/pagewalk.c:204
[<ffffffff81721174>] walk_page_range+0x134/0x300 mm/pagewalk.c:281
[<ffffffff8174cd9b>] queue_pages_range+0xfb/0x130 mm/mempolicy.c:687
[<ffffffff817555e1>] do_mbind+0x2c1/0xdc0 mm/mempolicy.c:1239
[< inline >] SYSC_mbind mm/mempolicy.c:1351
[<ffffffff8175643d>] SyS_mbind+0x13d/0x150 mm/mempolicy.c:1333
[<ffffffff86653236>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
Code: 89 df e8 5a 62 04 00 0f 0b e8 43 71 ed ff 4d 8d 6e ff e9 73 fb
ff ff e8 35 71 ed ff 48 c7 c6 a0 ab 79 86 48 89 df e8 36 62 04 00 <0f>
0b e8 1f 71 ed ff 4d 8d 6e ff e9 eb fb ff ff c7 45 d0 f0 ff
RIP [<ffffffff8169309a>] isolate_lru_page+0x4ea/0x6d0 mm/vmscan.c:1446
RSP <ffff88006c8f7a50>
---[ end trace 4b07319c03942d44 ]---
BUG: sleeping function called from invalid context at include/linux/sched.h:2805
in_atomic(): 1, irqs_disabled(): 0, pid: 8185, name: a.out
INFO: lockdep is turned off.
CPU: 1 PID: 8185 Comm: a.out Tainted: G D 4.5.0-rc1+ #300
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
00000000ffffffff ffff88006c8f7548 ffffffff82be118d ffff88006146c740
0000000000001ff9 0000000000000000 ffff88006c8f7570 ffffffff813cb8cb
ffff88006146c740 ffffffff867387a0 0000000000000af5 ffff88006c8f75b0
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff82be118d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
[<ffffffff813cb8cb>] ___might_sleep+0x27b/0x3a0 kernel/sched/core.c:7703
[<ffffffff813cba80>] __might_sleep+0x90/0x1a0 kernel/sched/core.c:7665
[< inline >] threadgroup_change_begin include/linux/sched.h:2805
[<ffffffff813830d1>] exit_signals+0x81/0x430 kernel/signal.c:2392
[<ffffffff8135c3dc>] do_exit+0x23c/0x2cb0 kernel/exit.c:701
[<ffffffff811aa28f>] oops_end+0x9f/0xd0 arch/x86/kernel/dumpstack.c:250
[<ffffffff811aa686>] die+0x46/0x60 arch/x86/kernel/dumpstack.c:316
[< inline >] do_trap_no_signal arch/x86/kernel/traps.c:205
[<ffffffff811a3b9f>] do_trap+0x18f/0x380 arch/x86/kernel/traps.c:251
[<ffffffff811a400e>] do_error_trap+0x11e/0x280 arch/x86/kernel/traps.c:290
[<ffffffff811a527b>] do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:303
[<ffffffff86654f4e>] invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:830
[< inline >] migrate_page_add mm/mempolicy.c:966
[<ffffffff8174efdd>] queue_pages_pte_range+0x4ad/0x10b0 mm/mempolicy.c:552
[< inline >] walk_pmd_range mm/pagewalk.c:50
[< inline >] walk_pud_range mm/pagewalk.c:90
[< inline >] walk_pgd_range mm/pagewalk.c:116
[<ffffffff817209c3>] __walk_page_range+0x653/0xcd0 mm/pagewalk.c:204
[<ffffffff81721174>] walk_page_range+0x134/0x300 mm/pagewalk.c:281
[<ffffffff8174cd9b>] queue_pages_range+0xfb/0x130 mm/mempolicy.c:687
[<ffffffff817555e1>] do_mbind+0x2c1/0xdc0 mm/mempolicy.c:1239
[< inline >] SYSC_mbind mm/mempolicy.c:1351
[<ffffffff8175643d>] SyS_mbind+0x13d/0x150 mm/mempolicy.c:1333
[<ffffffff86653236>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
note: a.out[8185] exited with preempt_count 1
On commit 92e963f50fc74041b5e9e744c330dca48e04f08d with Kirill recent fix:
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1261,7 +1261,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
}
sfp->mmap_called = 1;
- vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+ vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
vma->vm_private_data = sfp;
vma->vm_ops = &sg_mmap_vm_ops;
return 0;
Powered by blists - more mailing lists