linux-kernel - mm: BUG allocating pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <57607DA5.3060003@oracle.com>
Date:	Tue, 14 Jun 2016 17:56:53 -0400
From:	Sasha Levin <sasha.levin@...cle.com>
To:	LKML <linux-kernel@...r.kernel.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>
Subject: mm: BUG allocating pages

Hi all,

I've hit the following while fuzzing with syzkaller inside a KVM tools guest
running the latest -next kernel:

[  708.545446] page:ffffea0000790400 count:0 mapcount:0 mapping:          (null) index:0x1

[  708.547672] flags: 0x1fffff80000000()

[  708.548363] page dumped because: VM_BUG_ON_PAGE(!PageBuddy(page))

[  708.549505] ------------[ cut here ]------------

[  708.550264] kernel BUG at include/linux/page-flags.h:646!

[  708.551168] invalid opcode: 0000 [#1] PREEMPT SMP KASAN

[  708.552044] Modules linked in:

[  708.552640] CPU: 5 PID: 2952 Comm: trinity-c128 Tainted: G    B   W       4.7.0-rc3-next-20160614-sasha-00032-g8e3c1a2-dirty #3105

[  708.554605] task: ffff8803d2648000 ti: ffff8800c6770000 task.ti: ffff8800c6770000

[  708.555782] RIP: __rmqueue (include/linux/page-flags.h:646 mm/page_alloc.c:705 mm/page_alloc.c:1797 mm/page_alloc.c:2166)
[  708.557174] RSP: 0000:ffff8800c6776e98  EFLAGS: 00010086

[  708.557762] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000

[  708.558500] RDX: 1ffffd40000f2087 RSI: 0000000000000086 RDI: ffffea0000790438

[  708.559241] RBP: ffff8800c6776fb8 R08: 6d75642065676170 R09: 6163656220646570

[  708.559944] R10: 0000000000000000 R11: ffff880428d6d57f R12: ffff88009dfd4138

[  708.560661] R13: ffffea0000790418 R14: 0000000000000003 R15: 0000000000000010

[  708.561376] FS:  00007f5ad8e11700(0000) GS:ffff8803d7400000(0000) knlGS:0000000000000000

[  708.562224] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[  708.562827] CR2: 0000000000696fa0 CR3: 00000000cad6e000 CR4: 00000000000006a0

[  708.563573] Stack:

[  708.563798]  ffff8800c6776f18 ffffffff9f793633 ffffea0000790400 1ffff10018ceedde

[  708.564601]  0000000000000001 ffffea0000790420 00000000000000a0 ffffea0000790400

[  708.565550]  ffff88009dfd3000 ffffea0000000000 0000000000000001 0000000041b58ab3

[  708.566395] Call Trace:

[  708.570602] get_page_from_freelist (mm/page_alloc.c:2193 mm/page_alloc.c:2585 mm/page_alloc.c:2982)
[  708.572396] __alloc_pages_slowpath (mm/page_alloc.c:3600)
[  708.582146] __alloc_pages_nodemask (mm/page_alloc.c:3841)
[  708.587986] alloc_pages_vma (mm/mempolicy.c:2027)
[  708.589193] shmem_alloc_page (mm/shmem.c:1343 mm/shmem.c:1397)
[  708.592284] shmem_alloc_and_acct_page (mm/shmem.c:1426)
[  708.592950] shmem_getpage_gfp (mm/shmem.c:1702)
[  708.595464] shmem_write_begin (mm/shmem.c:123 mm/shmem.c:2163)
[  708.596055] generic_perform_write (mm/filemap.c:2712)
[  708.598479] __generic_file_write_iter (mm/filemap.c:2838)
[  708.599135] generic_file_write_iter (include/linux/fs.h:746 mm/filemap.c:2866)
[  708.599763] do_iter_readv_writev (fs/read_write.c:700)
[  708.602848] do_readv_writev (fs/read_write.c:847)
[  708.608499] vfs_writev (fs/read_write.c:886)
[  708.609018] do_writev (fs/read_write.c:920)
[  708.611922] SyS_writev (fs/read_write.c:989)
[  708.612430] do_syscall_64 (arch/x86/entry/common.c:350)
[  708.613040] entry_SYSCALL64_slow_path (arch/x86/entry/entry_64.S:251)
[ 708.613660] Code: 08 4c 89 ef e8 82 91 12 00 48 8b 85 08 ff ff ff 8b 40 f8 83 f8 80 74 21 48 8b bd 18 ff ff ff 48 c7 c6 80 b3 70 a9 e8 10 b2 07 00 <0f> 0b 48 c7 c7 80 25 8a ad e8 3f a2 ab 01 4c 89 e9 c7 45 98 ff

All code
========
   0:	08 4c 89 ef          	or     %cl,-0x11(%rcx,%rcx,4)
   4:	e8 82 91 12 00       	callq  0x12918b
   9:	48 8b 85 08 ff ff ff 	mov    -0xf8(%rbp),%rax
  10:	8b 40 f8             	mov    -0x8(%rax),%eax
  13:	83 f8 80             	cmp    $0xffffff80,%eax
  16:	74 21                	je     0x39
  18:	48 8b bd 18 ff ff ff 	mov    -0xe8(%rbp),%rdi
  1f:	48 c7 c6 80 b3 70 a9 	mov    $0xffffffffa970b380,%rsi
  26:	e8 10 b2 07 00       	callq  0x7b23b
  2b:*	0f 0b                	ud2    		<-- trapping instruction
  2d:	48 c7 c7 80 25 8a ad 	mov    $0xffffffffad8a2580,%rdi
  34:	e8 3f a2 ab 01       	callq  0x1aba278
  39:	4c 89 e9             	mov    %r13,%rcx
  3c:	c7                   	.byte 0xc7
  3d:	45 98                	rex.RB cwtl
  3f:	ff 00                	incl   (%rax)

Code starting with the faulting instruction
===========================================
   0:	0f 0b                	ud2
   2:	48 c7 c7 80 25 8a ad 	mov    $0xffffffffad8a2580,%rdi
   9:	e8 3f a2 ab 01       	callq  0x1aba24d
   e:	4c 89 e9             	mov    %r13,%rcx
  11:	c7                   	.byte 0xc7
  12:	45 98                	rex.RB cwtl
  14:	ff 00                	incl   (%rax)
[  708.616605] RIP __rmqueue (include/linux/page-flags.h:646 mm/page_alloc.c:705 mm/page_alloc.c:1797 mm/page_alloc.c:2166)
[  708.617184]  RSP <ffff8800c6776e98>