Re: [syzbot] [maple-tree?] BUG: unable to handle kernel paging request in mas_walk

Re: [syzbot] [maple-tree?] BUG: unable to handle kernel paging request in mas_walk

[Liam R. Howlett]

* syzbot <syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com> [240603 22:23]:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    4a4be1ad3a6e Revert "vfs: Delete the associated dentry whe..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=128638ba980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=bd6024aedb15e15c
> dashboard link: https://syzkaller.appspot.com/bug?extid=c67d06ab25a9bc4adf35
> compiler:       aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=106f71aa980000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b4ffc6980000
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-4a4be1ad.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/75957361122b/vmlinux-4a4be1ad.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/6c766b0ec377/Image-4a4be1ad.gz.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com
> 
> Unable to handle kernel paging request at virtual address 00700000077b9b78

Never a good thing.

I'm looking into this but it's not easily recreated because I keep
hitting another but with the reproducer [1].  I tried the HEAD commit
and the more recent v6.10-rc2.

I have a decent idea of what is going on here, but need to prove the
fix.

[1] https://syzkaller.appspot.com/bug?extid=7eaa0d7b9fccf21052f1

Thanks,
Liam

Re: [syzbot] [maple-tree?] BUG: unable to handle kernel paging request in mas_walk

[Liam R. Howlett]

* syzbot <syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com> [240603 22:23]:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    4a4be1ad3a6e Revert "vfs: Delete the associated dentry whe..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=128638ba980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=bd6024aedb15e15c
> dashboard link: https://syzkaller.appspot.com/bug?extid=c67d06ab25a9bc4adf35
> compiler:       aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=106f71aa980000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b4ffc6980000
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-4a4be1ad.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/75957361122b/vmlinux-4a4be1ad.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/6c766b0ec377/Image-4a4be1ad.gz.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com
> 
> Unable to handle kernel paging request at virtual address 00700000077b9b78

#sys test git://git.infradead.org/users/jedix/linux-maple.git syz_20240603

Re: [syzbot] [maple-tree?] BUG: unable to handle kernel paging request in mas_walk

[Liam R. Howlett]

* syzbot <syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com> [240603 22:23]:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    4a4be1ad3a6e Revert "vfs: Delete the associated dentry whe..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=128638ba980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=bd6024aedb15e15c
> dashboard link: https://syzkaller.appspot.com/bug?extid=c67d06ab25a9bc4adf35
> compiler:       aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=106f71aa980000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b4ffc6980000
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-4a4be1ad.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/75957361122b/vmlinux-4a4be1ad.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/6c766b0ec377/Image-4a4be1ad.gz.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com
> 
> Unable to handle kernel paging request at virtual address 00700000077b9b78

I don't think the bot is testing my forced update of the tree, so I'll
try again.

#sys test git://git.infradead.org/users/jedix/linux-maple.git syz_20240603_v2

This is a revert a some patches - which seems to stop all the crashing
for me.

Looks to be the same as this [1] syzbot report.  All seem to be related
to madvise and these patches are the last to modify the area (besides
mseal() specifically calling out madvise, but that would not cause the
issue).

The patches I revered also name arm64 as special.

[1] https://syzkaller.appspot.com/bug?extid=7eaa0d7b9fccf21052f1

Re: [syzbot] [maple-tree?] BUG: unable to handle kernel paging request in mas_walk

[Liam R. Howlett]

* Liam R. Howlett <Liam.Howlett@oracle.com> [240604 14:08]:
> * syzbot <syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com> [240603 22:23]:
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    4a4be1ad3a6e Revert "vfs: Delete the associated dentry whe..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=128638ba980000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=bd6024aedb15e15c
> > dashboard link: https://syzkaller.appspot.com/bug?extid=c67d06ab25a9bc4adf35
> > compiler:       aarch64-linux-gnu-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> > userspace arch: arm64
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=106f71aa980000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16b4ffc6980000
> > 
> > Downloadable assets:
> > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/384ffdcca292/non_bootable_disk-4a4be1ad.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/75957361122b/vmlinux-4a4be1ad.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/6c766b0ec377/Image-4a4be1ad.gz.xz
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+c67d06ab25a9bc4adf35@syzkaller.appspotmail.com
> > 
> > Unable to handle kernel paging request at virtual address 00700000077b9b78
> 
> I don't think the bot is testing my forced update of the tree, so I'll
> try again.
> 
> #sys test git://git.infradead.org/users/jedix/linux-maple.git syz_20240603_v2
> 
> This is a revert a some patches - which seems to stop all the crashing
> for me.
> 
> Looks to be the same as this [1] syzbot report.  All seem to be related
> to madvise and these patches are the last to modify the area (besides
> mseal() specifically calling out madvise, but that would not cause the
> issue).
> 
> The patches I revered also name arm64 as special.
> 
> [1] https://syzkaller.appspot.com/bug?extid=7eaa0d7b9fccf21052f1

This should be fixed in 6.10-rc3 because of the arm fix in the area I
suspected.  I have no way of verifying that since the bot decided to
stop responding.

This puts us in a difficult situation of needing to jump on bot bugs for
security concerns and wasting copious amounts of time chasing our own
tails.