linux-kernel - Re: [syzbot] [mm?] WARNING: suspicious RCU usage in mas

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0000000000001f3ae506017c704b@google.com>
Date:   Thu, 27 Jul 2023 11:50:28 -0700
From:   syzbot <syzbot+8645fe63c4d22c8d27b8@...kaller.appspotmail.com>
To:     willy@...radead.org
Cc:     akpm@...ux-foundation.org, liam.howlett@...cle.com,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        syzkaller-bugs@...glegroups.com, willy@...radead.org
Subject: Re: [syzbot] [mm?] WARNING: suspicious RCU usage in mas_walk (2)

> On Tue, Jul 25, 2023 at 11:57:22PM -0700, syzbot wrote:
>> syzbot has bisected this issue to:
>
> FWIW, this is unrelated to the previous issue.  It's the caller of
> mas_walk() that has violated the locking constraints, and mas_walk() is
> simply reporting the issue.  Is there a way to get syzbot to understand
> that it needs to unwind the call-stack further to decide who to blame?
>
>> commit a52f58b34afe095ebc5823684eb264404dad6f7b
>> Author: Matthew Wilcox (Oracle) <willy@...radead.org>
>> Date:   Mon Jul 24 18:54:10 2023 +0000
>> 
>>     mm: handle faults that merely update the accessed bit under the VMA lock
>> 
>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1783585ea80000
>> start commit:   [unknown] 
>> git tree:       linux-next
>> final oops:     https://syzkaller.appspot.com/x/report.txt?x=1443585ea80000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1043585ea80000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=f481ab36ce878b84
>> dashboard link: https://syzkaller.appspot.com/bug?extid=8645fe63c4d22c8d27b8
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1697cec9a80000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1566986ea80000
>
> #syz test

want 2 args (repo, branch), got 4

>
> diff --git a/mm/memory.c b/mm/memory.c
> index 20a2e9ed4aeb..57b271108bdc 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -3567,6 +3567,12 @@ static vm_fault_t do_wp_page(struct vm_fault *vmf)
>  		return 0;
>  	}
>  copy:
> +	if ((vmf->flags & FAULT_FLAG_VMA_LOCK) && !vma->anon_vma) {
> +		pte_unmap_unlock(vmf->pte, vmf->ptl);
> +		vma_end_read(vmf->vma);
> +		return VM_FAULT_RETRY;
> +	}
> +
>  	/*
>  	 * Ok, we need to copy. Oh, well..
>  	 */