KASAN: user-memory-access Read in put

KASAN: user-memory-access Read in put_page

Status: closed as dup on 2020/06/27 21:18
Subsystems: arch
[Documentation on labels]
Reported-by: syzbot+b4501d3e966ff59f6090@syzkaller.appspotmail.com
First crash: 1828d, last: 1828d

Cause bisection: introduced by (bisect log) :
commit 4426e945df588f2878affddf88a51259200f7e29
Author: Peter Xu <peterx@redhat.com>
Date: Thu Apr 2 04:08:49 2020 +0000

mm/gup: allow VM_FAULT_RETRY for multiple times

Crash: general protection fault in kernel_get_mempolicy (log)
Repro: C syz .config

Fix bisection: failed (error log, bisect log)

▶ ▼ Duplicate of

Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported
BUG: unable to handle kernel paging request in kernel_get_mempolicy mm	C	done		1	1828d	1824d

▶ ▼ Discussions (1)

Title	Replies (including bot)	Last reply
KASAN: user-memory-access Read in put_page	1 (2)	2020/04/06 23:21

Sample crash report:

==================================================================
BUG: KASAN: user-memory-access in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: user-memory-access in page_ref_count include/linux/page_ref.h:67 [inline]
BUG: KASAN: user-memory-access in put_page_testzero include/linux/mm.h:675 [inline]
BUG: KASAN: user-memory-access in put_page+0x110/0x1d0 include/linux/mm.h:1136
Read of size 4 at addr 00003fbf7e8680b0 by task syz-executor574/7201

CPU: 0 PID: 7201 Comm: syz-executor574 Not tainted 5.6.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1e9/0x30e lib/dump_stack.c:118
 __kasan_report+0x122/0x190 mm/kasan/report.c:507
 kasan_report+0x4d/0x80 mm/kasan/common.c:648
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 7201 Comm: syz-executor574 Tainted: G    B             5.6.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1e9/0x30e lib/dump_stack.c:118
 panic+0x264/0x7a0 kernel/panic.c:221
 end_report mm/kasan/report.c:96 [inline]
 __kasan_report+0x187/0x190 mm/kasan/report.c:510
 kasan_report+0x4d/0x80 mm/kasan/common.c:648
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (3):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Manager
2020/04/03 15:27	upstream	bef7b2a7be28	5ed396e6	.config	console log	report	syz	C	ci-upstream-kasan-gce-smack-root
2020/04/03 12:40	upstream	bef7b2a7be28	5ed396e6	.config	console log	report			ci-upstream-kasan-gce-smack-root
2020/04/03 12:09	upstream	bef7b2a7be28	5ed396e6	.config	console log	report			ci-upstream-kasan-gce-smack-root

* ~~Struck through~~ repros no longer work on HEAD.