linux-kernel - Re: kernel BUG in memory_bm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+ZjVc+_fg+Ggx8zRWSGqzf4gmZcngBXLf_R4F-GKU4a9A@mail.gmail.com>
Date:   Mon, 15 Mar 2021 08:08:06 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     syzbot <syzbot+5ecbe63baca437585bd4@...kaller.appspotmail.com>
Cc:     Len Brown <len.brown@...el.com>,
        LKML <linux-kernel@...r.kernel.org>, linux-pm@...r.kernel.org,
        "Rafael J. Wysocki" <rjw@...ysocki.net>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        kasan-dev <kasan-dev@...glegroups.com>,
        Catalin Marinas <catalin.marinas@....com>,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        Andrey Konovalov <andreyknvl@...gle.com>,
        Pavel Machek <pavel@....cz>
Subject: Re: kernel BUG in memory_bm_free

On Wed, Feb 3, 2021 at 6:59 AM syzbot
<syzbot+5ecbe63baca437585bd4@...kaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> userspace arch: arm64
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+5ecbe63baca437585bd4@...kaller.appspotmail.com

The BUG is:
BUG_ON(!virt_addr_valid(addr));

#syz fix: arm64: Do not pass tagged addresses to __is_lm_address()

> ------------[ cut here ]------------
> kernel BUG at kernel/power/snapshot.c:257!
> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 1 PID: 2394 Comm: syz-executor.0 Not tainted 5.11.0-rc6-syzkaller-00055-g3aaf0a27ffc2 #0
> Hardware name: linux,dummy-virt (DT)
> pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--)
> pc : free_image_page kernel/power/snapshot.c:257 [inline]
> pc : free_image_page kernel/power/snapshot.c:253 [inline]
> pc : free_list_of_pages kernel/power/snapshot.c:274 [inline]
> pc : memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
> lr : free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
> sp : ffff8000163dbc50
> x29: ffff8000163dbc50 x28: f4ff000025204070
> x27: ffff800012d4c000 x26: f4ff000025204008
> x25: f5ff00002827c700 x24: ffff800012d4c000
> x23: 00007fffffffffff x22: f4ff000025204018
> x21: 0000000000000001 x20: ffff800013b576d0
> x19: f5ff00002827c700 x18: 0000000000000000
> x17: 0000000000000000 x16: 0000000000000000
> x15: 0000000000000000 x14: 0000000000000000
> x13: 0000000000000000 x12: 0000000000000000
> x11: 0000000000000000 x10: 0000000000000000
> x9 : fcff000025205400 x8 : 0000000000000002
> x7 : f6ff000025205000 x6 : 00000000000001ff
> x5 : 0000000000000000 x4 : 0000000000000000
> x3 : ffff800013b576d0 x2 : f4ff00002517e000
> x1 : 0000000000000001 x0 : 0b0000002517e000
> Call trace:
>  free_image_page kernel/power/snapshot.c:257 [inline]
>  free_list_of_pages kernel/power/snapshot.c:274 [inline]
>  memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
>  free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
>  snapshot_release+0x74/0x90 kernel/power/user.c:120
>  __fput+0x78/0x230 fs/file_table.c:280
>  ____fput+0x10/0x20 fs/file_table.c:313
>  task_work_run+0x80/0x160 kernel/task_work.c:140
>  tracehook_notify_resume include/linux/tracehook.h:189 [inline]
>  do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939
>  work_pending+0xc/0x3d4
> Code: cb000260 d34cfc00 97fcf6fe 35fffc20 (d4210000)
> ---[ end trace 174c294156b0dfb3 ]---
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@...glegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.