Re: [syzbot] [mm?] WARNING in __page_table_check_ptes_set (2)

[Andrew Morton]

On Wed, 12 Jun 2024 10:18:21 -0700 syzbot <syzbot+0b56d6ed0d0c0c9a79dc@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    8867bbd4a056 mm: arm64: Fix the out-of-bounds issue in con..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=146b3d96980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3b4350cf56c61c80
> dashboard link: https://syzkaller.appspot.com/bug?extid=0b56d6ed0d0c0c9a79dc
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> userspace arch: arm64
> 
> Unfortunately, I don't have any reproducer for this issue yet.
>
> ...
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 page_table_check_pte_flags mm/page_table_check.c:198 [inline]
> WARNING: CPU: 1 PID: 1 at mm/page_table_check.c:198 __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211

	if (pte_present(pte) && pte_uffd_wp(pte))
		WARN_ON_ONCE(pte_write(pte));

Let me optimistically cc Peter ;)

> Modules linked in:
> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc2-syzkaller-g8867bbd4a056 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
> pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : page_table_check_pte_flags mm/page_table_check.c:198 [inline]
> pc : __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
> lr : page_table_check_pte_flags mm/page_table_check.c:198 [inline]
> lr : __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
> sp : ffff800093d57520
> x29: ffff800093d575a0 x28: ffff7000127aaec8 x27: dfff800000000000
> x26: 0000000000000001 x25: bfeffffffffffff3 x24: 1ffff000127aaea8
> x23: 0408000000000000 x22: 0000000000000001 x21: ffff0000d38131b8
> x20: ffff800093d57540 x19: 0408000000000000 x18: ffff800093d57300
> x17: 00000000000074be x16: ffff800080b0d2d4 x15: ffff7000127aaeb0
> x14: 1ffff000127aaeb0 x13: 0000000000000004 x12: ffffffffffffffff
> x11: ffff80008eb6e78c x10: 0000000000ff0100 x9 : 0000000000000000
> x8 : ffff0000c1968000 x7 : ffff80008096b550 x6 : 0000000000000000
> x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
> x2 : bfeffffffffffff3 x1 : 0408000000000000 x0 : 0408000000000000
> Call trace:
>  page_table_check_pte_flags mm/page_table_check.c:198 [inline]
>  __page_table_check_ptes_set+0x324/0x398 mm/page_table_check.c:211
>  page_table_check_ptes_set include/linux/page_table_check.h:74 [inline]
>  __set_ptes arch/arm64/include/asm/pgtable.h:404 [inline]
>  set_ptes arch/arm64/include/asm/pgtable.h:1586 [inline]
>  pte_clear_tests+0x510/0x538 mm/debug_vm_pgtable.c:640
>  debug_vm_pgtable+0x268/0x590 mm/debug_vm_pgtable.c:1392
>  do_one_initcall+0x254/0x9e4 init/main.c:1267
>  do_initcall_level+0x154/0x214 init/main.c:1329
>  do_initcalls+0x58/0xac init/main.c:1345
>  do_basic_setup+0x8c/0xa0 init/main.c:1364
>  kernel_init_freeable+0x324/0x478 init/main.c:1578
>  kernel_init+0x24/0x2a0 init/main.c:1467
>  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
> irq event stamp: 1342246
> hardirqs last  enabled at (1342245): [<ffff8000809ba500>] seqcount_lockdep_reader_access+0x6c/0xd4 include/linux/seqlock.h:74
> hardirqs last disabled at (1342246): [<ffff80008af10a10>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:470
> softirqs last  enabled at (1342178): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline]
> softirqs last  enabled at (1342178): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582
> softirqs last disabled at (1341257): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588
> ---[ end trace 0000000000000000 ]---
> page_owner is disabled
> Key type .fscrypt registered
> Key type fscrypt-provisioning registered
> kAFS: Red Hat AFS client v0.1 registering.
> Btrfs loaded, assert=on, ref-verify=on, zoned=yes, fsverity=yes
> Key type big_key registered
> Key type encrypted registered
> ima: No TPM chip found, activating TPM-bypass!
> Loading compiled-in module X.509 certificates
> Loaded X.509 cert 'Build time autogenerated kernel key: 79e1c0a63a233d95d926db3e542dc8d9e342ab6b'
> ima: Allocated hash algorithm: sha256
> ima: No architecture policies found
> evm: Initialising EVM extended attributes:
> evm: security.selinux (disabled)
> evm: security.SMACK64
> evm: security.SMACK64EXEC
> evm: security.SMACK64TRANSMUTE
> evm: security.SMACK64MMAP
> evm: security.apparmor (disabled)
> evm: security.ima
> evm: security.capability
> evm: HMAC attrs: 0x1
> printk: legacy console [netcon0] enabled
> netconsole: network logging started
> gtp: GTP module loaded (pdp ctx size 128 bytes)
> rdma_rxe: loaded
> cfg80211: Loading compiled-in X.509 certificates for regulatory database
> Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
> Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
> clk: Disabling unused clocks
> PM: genpd: Disabling unused power domains
> ALSA device list:
>   #0: Dummy 1
>   #1: Loopback 1
>   #2: Virtual MIDI Card 1
> md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
> EXT4-fs (nvme0n1p2): mounted filesystem 126e38a5-b482-40da-8f06-bd78886e02c1 ro with ordered data mode. Quota mode: none.
> VFS: Mounted root (ext4 filesystem) readonly on device 259:2.
> devtmpfs: mounted
> Freeing unused kernel memory: 4416K
> Run /sbin/init as init process
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup