From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C33FBC4167B for ; Fri, 8 Dec 2023 14:12:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3B95F6B007E; Fri, 8 Dec 2023 09:12:21 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 38F3A6B0087; Fri, 8 Dec 2023 09:12:21 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 256B86B0089; Fri, 8 Dec 2023 09:12:21 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 0B2E46B007E for ; Fri, 8 Dec 2023 09:12:21 -0500 (EST) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id D84C11A01D2 for ; Fri, 8 Dec 2023 14:12:20 +0000 (UTC) X-FDA: 81543840840.18.33ABB91 Received: from mail-ed1-f46.google.com (mail-ed1-f46.google.com [209.85.208.46]) by imf22.hostedemail.com (Postfix) with ESMTP id 16D5EC0016 for ; Fri, 8 Dec 2023 14:12:17 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=saofLVZ7; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf22.hostedemail.com: domain of jannh@google.com designates 209.85.208.46 as permitted sender) smtp.mailfrom=jannh@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1702044738; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=/ABC8R/IhSJq1v/g+J7leg1/ZK2tJ16+5uzlBgeMWDk=; b=k5w38gnBWOCa5jGaBQ/rLGaNOpneyocC4kXKJRQGHkbby/I3gJNnaeIyzjiRfBqaK8rL7a +HYz9MQ7P6wFkjr7GACFAdfLYHo8Ak+aZpNSNgsiTGSM9CTOYEYKXKvIkWs8nV9LsH3g4U 1mTWcOhTIWcy9d2Qx+oMVihKGf2Cx/Q= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=saofLVZ7; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf22.hostedemail.com: domain of jannh@google.com designates 209.85.208.46 as permitted sender) smtp.mailfrom=jannh@google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1702044738; a=rsa-sha256; cv=none; b=sjhRYbFHm4vZFF6Tq6Fu9Ts6iCjmlbYDkpU6uDjbiCgDqYtuz36jnX1tVfT/GLuY+BOayL SibwUKhSUtHAbVsQ+C+mu0t0XSnXxr3btumLao5BgWh84UgE2IqvZLJnCYthLZRBGajx3h YJCgmVzGMWkl82hE8oGdX18IWoBOTE0= Received: by mail-ed1-f46.google.com with SMTP id 4fb4d7f45d1cf-54c77d011acso7718a12.1 for ; Fri, 08 Dec 2023 06:12:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1702044736; x=1702649536; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=/ABC8R/IhSJq1v/g+J7leg1/ZK2tJ16+5uzlBgeMWDk=; b=saofLVZ7eO5NcGh+puxy0tG5xLP7Uk1gkUYQIdNZRXP7gg5JOVfisPEPmQPoFBhmGP BFm8XScO6vOop59rMi0DBS3egTTYUFVKzzQnL82sXdrwZ5hF4dPZG6p+ANdwUiYT3ccx WufktEZuOWzVIVzG27S+jQW5shuvMxwhQCrQkh+wMzoYeEpFTjC9ZYLWV20xw65t548P XohfFs8Q7qHFkn1sPJxZ8IEcndY5P76ChifqUE+/Q6mqSBYxustZrBQeWUcVPreHWiNW qoMfhC8XAgCM84xY5c8JvknPmsgHUbilQ9sy+vf0JIKkFhxft2HL9eRXIreqlxyqwmgA 8dfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702044736; x=1702649536; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/ABC8R/IhSJq1v/g+J7leg1/ZK2tJ16+5uzlBgeMWDk=; b=SLkH/T5hvwqJJqKFA+TDXlZ0c9n+jzu6f0wn4m/h4HOZoMCzhw1K1/sbjlKg2D1IL2 FC2zrCUZNUjUd2V5Y4VQs/xMoVqh4JI2NJg0JFg3E7KlioAY6tjXEMXC2EHF0UodvygU ANzdrYxvgWmyK2jFNoEApdsnBkVWAiuIr7u/aV9lGPovSf87dxT2+khqa1tboUgjawuS j+tXa9djl1WqjM0qGf4vaxAD14t/Qza5+Kh5Et4Mv1Do8tEJcy3R3GMIpO4L8wgiu1lw FXD8tPIuvTT0sbYXqiqkHrs4YWQgW/TUVmyZmpZqBW9vw+Yoge/bOwVg593V+xzWlU9R KNTA== X-Gm-Message-State: AOJu0Yyy6YSQ/zXFgZVNTI93WLWoWsAGHaR4WCDqV8WyJMCtCT+xPHYA 9KXH4JkxF8RhIrY3c2jpRIuFCIIchNFifaN8ku/NLQ== X-Google-Smtp-Source: AGHT+IFUiwNJtELR2LOdUwBqhHceu0+lQwsc9S9bVzH1TniVpOsxIhVb55HaEcFpO/J3dhkzkXSaYntASjqvIfugTWM= X-Received: by 2002:a50:f618:0:b0:54c:79ed:a018 with SMTP id c24-20020a50f618000000b0054c79eda018mr53716edn.2.1702044736317; Fri, 08 Dec 2023 06:12:16 -0800 (PST) MIME-Version: 1.0 References: <000000000000c84343060a850bd0@google.com> <87jzqb1133.ffs@tglx> In-Reply-To: <87jzqb1133.ffs@tglx> From: Jann Horn Date: Fri, 8 Dec 2023 15:11:38 +0100 Message-ID: Subject: Re: [syzbot] [mm?] BUG: unable to handle kernel paging request in copy_from_kernel_nofault To: Thomas Gleixner , Alexei Starovoitov , Daniel Borkmann , John Fastabend , bpf Cc: syzbot , akpm@linux-foundation.org, bp@alien8.de, bp@suse.de, dave.hansen@linux.intel.com, hpa@zytor.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, luto@kernel.org, mingo@redhat.com, netdev@vger.kernel.org, peterz@infradead.org, syzkaller-bugs@googlegroups.com, x86@kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 16D5EC0016 X-Stat-Signature: if4n68bpnu9e3kpq49w983nb76a9wcyo X-HE-Tag: 1702044737-611507 X-HE-Meta: U2FsdGVkX18w10KksbInoUaSs1FOpZN7kNdR7oi+0Dnq+Z7/lVVfBYXFUD5KRUjTdaK0kG1POzW69l3583Q81C7CMivLgDAPFR1SvLBwK5N/gTh6xAApoHH2BtTMwyMPaZgGI2Fjnv6fa7Uvi3qUaICvGvHbP7yTKmzOF9d+qQs4noC1dXA57hjH4tTbjxV7uMPMQbF5bDTZGC1ZkzNMzKHbCe4ViXlLXj+TRlpfUBLSwgFl8TQpNKOB/DSMrgS/6xDORYPTA+H/BF/DD94Te3QtaOZsZq0qpRMp0UteUTFD3l0pYUAS0GGcG5NoWxWzTD3DEDFrGKiNbZ+G+nrl/qij9yo5ce3DqAttYscNXLg3LyVY+qysgnYIzlVCKv6xhAw633/litXyS1Qu597XcKCk7Fv8FBWC1zu8r6iRz1EgEwP2qM9nP+aau/1AOok+pfctPXdpRFPNM7PHizECtnV2xRMs40FvhR0HhzgPkRWP/cQkevNzUA6JhswvhFuPeNWqs/1qZtXyvyqAI1I/voCKmxbwHFyChLn5Fnz74S4aMP4gdpa2uDMLDbiQTMbGlIjaMNd84PdoqRb50yee16oQfg4+zWz3aHMR7tC2FMRw1hucrJmgtJ58MjFhamR/NbQ/1DDl7cLo0n9nMgMDcjtLXyLb4TKi4eVUy2YPIIG4AjpcMUSWhmgHYdoAIOK7DkjOGEdXkC+uh/4WP3M0b2Qhy0Ab+jzrOkCR5MACB+FM1okfwJGkwuDQIFNLqAz5R6D5R/o1dr9aeoOUj6niVZJX4Z3FVcDD1euqMFflL0OZA7ddjDoQYnYgJ1zguvy5675FcSrPL+6BqsJuXSu9DQUJd/9bkmodfkruPb0TFaM1Znp8G0qL8b8S/rYWySUG4ntVrplYwuvadJsj5yAdqokd3ZdVtey3/OffKVCcBSvt++AV44+g7GONVY4TpqX9JrdFetCbDMmzuqaQmpB UC3yDj7j r+m1g1bAyExStjze5bT0gVDkeSDR+9Kf+RqIK2tgf4OOVANYjSl106aXb9SMmWldTvHMYVUsMLrHhghXIrwnhefD94nDOeidSPvNvIRFi8ZQEme2RvspPdxuImcvKfTI+GMHBdySkf5/16qKEBmVqAtFQmO1bIuow/w5VHyzKb1R5t21CPxfQaFyLvh0OU+lr6a+gIVRZ771AgDp7bzy7ZXsV8gijyes4QjpvbLhYBJiXSjpWQlASDBgvp13K1Z72lJIeqtKY9ziHgWmyAKDzPH+LEySr5k5sQA5aUJBld1Mfah9iVGd8Tii2DkJ3pySJNUGctV/40Pi3eXl1LhAI/SIcSu5hX33I1Phs1/X3RVNe8s1ePKmGtbA7gSxabayADMwJEip7Aj/gBpjjEYTa6naMVAD2OoAZef1SlgEM+soZbWi4M5HidOGHUl8rwzyawoZjHO6U8qjxWZ2RCSHAW9nQQJT9T4RzJnkaL+ieyTh23xuq/7cIDK0c4Qf7xvxjHy+NqPKMpYXaft1+Xb5UlgPcgGO0fOjW5ameGqujEccM2x1Cktp5VTLyrD3obZpTaiR/dPNuOjtUItrY+snMaen74oqQnoYd0rZWDzKy6iIkWO1odWHogc3+U6SxCSS54azJ9kVjQyZRYwV8XBrmSSqcid0ahqc76cLCGtMGjC4MR1rKKLiMB76bM5RQgWujirQ2WJPII2fFLVJAaSBOaepEtPiBEbAJiOH0hM2huht44EWy1SIM3tsQedmCvGH3DOEz9x4JZxBJom+OM5+K32Z4eVOi7PAEC7RwfzAgcrITubn6psnBCM4j6kxXUdrL24YgJwULIPFltJlmtdQA/kzZF9MJrEQPjXry25yBiYmA+VZUpYn7rPkGWv2LQG3C3o4x+Egdtrcy2hb1mFCQU3QYLw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Nov 21, 2023 at 6:13=E2=80=AFPM Thomas Gleixner wrote: > On Sun, Nov 19 2023 at 09:53, syzbot wrote: > > HEAD commit: 1fda5bb66ad8 bpf: Do not allocate percpu memory at init= st.. > > git tree: bpf > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=3D12d99420e80= 000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=3D2ae0ccd6bfd= e5eb0 > > dashboard link: https://syzkaller.appspot.com/bug?extid=3D72aa0161922eb= a61b50e > > compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for= Debian) 2.40 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=3D16dff22f6= 80000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=3D1027dc70e80= 000 > > > > Downloadable assets: > > disk image: https://storage.googleapis.com/syzbot-assets/3e24d257ce8d/d= isk-1fda5bb6.raw.xz > > vmlinux: https://storage.googleapis.com/syzbot-assets/eaa9caffb0e4/vmli= nux-1fda5bb6.xz > > kernel image: https://storage.googleapis.com/syzbot-assets/16182bbed726= /bzImage-1fda5bb6.xz > > > > The issue was bisected to: > > > > commit ca247283781d754216395a41c5e8be8ec79a5f1c > > Author: Andy Lutomirski > > Date: Wed Feb 10 02:33:45 2021 +0000 > > > > x86/fault: Don't run fixups for SMAP violations > > Reverting that makes the Ooops go away, but wrongly so. > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=3D103d92db= 680000 > > final oops: https://syzkaller.appspot.com/x/report.txt?x=3D123d92db= 680000 > > console output: https://syzkaller.appspot.com/x/log.txt?x=3D143d92db680= 000 > > > > IMPORTANT: if you fix the issue, please add the following tag to the co= mmit: > > Reported-by: syzbot+72aa0161922eba61b50e@syzkaller.appspotmail.com > > Fixes: ca247283781d ("x86/fault: Don't run fixups for SMAP violations") > > > > BUG: unable to handle page fault for address: ffffffffff600000 > > This is VSYSCALL_ADDR. > > So the real question is why the BPF program tries to copy from the > VSYSCALL page, which is not mapped. The linked syz repro is: r0 =3D bpf$PROG_LOAD(0x5, &(0x7f00000000c0)=3D{0x11, 0xb, &(0x7f0000000180)=3D@framed=3D{{}, [@printk=3D{@integer, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xff600000}, {0x85, 0x0, 0x0, 0x71}}]}, &(0x7f0000000200)=3D'GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)=3D{&(0x7f0000000000)=3D'kfree\x00', r0}, 0x10) So syzkaller generated a BPF tracing program. 0x85 is BPF_JMP | BPF_CALL, which is used to invoke BPF helpers; 0x71 is 113, which is the number of the probe_read_kernel helper, which basically takes arbitrary values as input and casts them to kernel pointers, and then probe-reads them. And before that is some kinda ALU op with 0xff600000 as immediate. So it looks like the answer to that question is "the BPF program tries to copy from the VSYSCALL page because syzkaller decided to write BPF code that does specifically that, and the BPF helper let it do that". copy_from_kernel_nofault() does check copy_from_kernel_nofault_allowed() to make sure the pointer really is a kernel pointer, and the X86 version of that rejects anything in the userspace part of the address space. But it does not know about the vsyscall area.