linux-kernel - Re: [bpf] 755e5d5536: BUG:Bad_page_map_in

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210113185816.GA359892@carbon.DHCP.thefacebook.com>
Date:   Wed, 13 Jan 2021 10:58:16 -0800
From:   Roman Gushchin <guro@...com>
To:     kernel test robot <oliver.sang@...el.com>
CC:     Alexei Starovoitov <ast@...nel.org>,
        Song Liu <songliubraving@...com>,
        LKML <linux-kernel@...r.kernel.org>, <lkp@...ts.01.org>,
        <lkp@...el.com>
Subject: Re: [bpf]  755e5d5536: BUG:Bad_page_map_in_process

On Tue, Jan 12, 2021 at 09:27:51PM +0800, kernel test robot wrote:
> 
> Greeting,
> 
> FYI, we noticed the following commit (built with gcc-9):
> 
> commit: 755e5d55367af5ff75a4db9b6cf439416878e2c7 ("bpf: Eliminate rlimit-based memory accounting for hashtab maps")
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> 
> 
> in testcase: trinity
> version: trinity-i386-4d2343bd-1_20200320
> with following parameters:
> 
> 	runtime: 300s
> 
> test-description: Trinity is a linux system call fuzz tester.
> test-url: http://codemonkey.org.uk/projects/trinity/ 
> 
> 
> on test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 8G
> 
> caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
> 
> 
> +------------------------------------------------------------+------------+------------+
> |                                                            | 844f157f6c | 755e5d5536 |
> +------------------------------------------------------------+------------+------------+
> | BUG:Bad_page_map_in_process                                | 0          | 9          |
> | BUG:Bad_page_state_in_process                              | 0          | 9          |
> | BUG:Bad_rss-counter_state_mm:(ptrval)type:MM_FILEPAGES_val | 0          | 1          |
> | BUG:Bad_rss-counter_state_mm:#type:MM_FILEPAGES_val        | 0          | 8          |
> | WARNING:at_mm/vmalloc.c:#vmap_pte_range                    | 0          | 3          |
> | EIP:vmap_pte_range                                         | 0          | 3          |
> | BUG:unable_to_handle_page_fault_for_address                | 0          | 1          |
> | Oops:#[##]                                                 | 0          | 1          |
> | EIP:free_percpu                                            | 0          | 1          |
> | EIP:__rb_reserve_next                                      | 0          | 1          |
> | WARNING:at_mm/percpu-vm.c:#__pcpu_balance_workfn           | 0          | 1          |
> | EIP:__pcpu_balance_workfn                                  | 0          | 1          |
> | WARNING:at_mm/vmalloc.c:#unmap_kernel_range_noflush        | 0          | 1          |
> | EIP:unmap_kernel_range_noflush                             | 0          | 1          |
> +------------------------------------------------------------+------------+------------+
> 
> 
> If you fix the issue, kindly add following tag
> Reported-by: kernel test robot <oliver.sang@...el.com>

I've tried to reproduce the problem on two different machines running the test case many times,
but haven't succeed yet. I wonder though, if it's the same problem as described and fixed by
commit e1868b9e36d0 ("bpf: Avoid overflows involving hash elem_size").

Thanks!