Messages in this thread | | | From | Thomas Gleixner <> | Subject | Re: general protection fault in get_futex_key | Date | Wed, 08 Apr 2020 15:36:45 +0200 |
| |
syzbot <syzbot+a95c7753605c9d219466@syzkaller.appspotmail.com> writes: > syzbot found the following crash on: > > HEAD commit: 763dede1 Merge tag 'for-linus-5.7-rc1' of git://git.kernel.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=136a055de00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=12205d036cec317f > dashboard link: https://syzkaller.appspot.com/bug?extid=a95c7753605c9d219466 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1578287de00000 > > The bug was bisected to: > > commit 4426e945df588f2878affddf88a51259200f7e29 > Author: Peter Xu <peterx@redhat.com> > Date: Thu Apr 2 04:08:49 2020 +0000 > > mm/gup: allow VM_FAULT_RETRY for multiple times > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1707878fe00000 > final crash: https://syzkaller.appspot.com/x/report.txt?x=1487878fe00000 > console output: https://syzkaller.appspot.com/x/log.txt?x=1087878fe00000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+a95c7753605c9d219466@syzkaller.appspotmail.com > Fixes: 4426e945df58 ("mm/gup: allow VM_FAULT_RETRY for multiple times") > > general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN > KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] > CPU: 1 PID: 8869 Comm: syz-executor.1 Not tainted 5.6.0-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline] > RIP: 0010:compound_head include/linux/page-flags.h:174 [inline] > RIP: 0010:get_futex_key+0x2cd/0x1670 kernel/futex.c:574
This means that
get_user_pages_fast(address, 1, FOLL_WRITE, &page)
returned 0, which is breaking the interface:
* Returns number of pages pinned. This may be fewer than the number requested. * If nr_pages is 0 or negative, returns 0. If no pages were pinned, returns * -errno.
nr_pages is clearly 1. So if the call fails, the number of pinned pages is 0 and it should return a proper error number. It did before.
From a quick look at the commit in question I assume it's the
+ if (fatal_signal_pending(current)) + break;
which can cause that to happen.
Thanks,
tglx
| |